fix: honor custom watermark settings in PDF preview

Merge pull request #780 from kekingcn/release/5.0.2
Release v5.0.2
2026-11-13 14:50:40 +00:00 · 2026-08-25 08:39:11 +08:00 · 2026-08-14 14:33:28 +08:00 · 2026-08-14 14:28:41 +08:00 · 2026-08-14 14:14:37 +08:00 · 2026-08-14 14:12:17 +08:00
62 changed files with 5700 additions and 1674 deletions
--- a/.github/scripts/deploy_windows_winrm.py
+++ b/.github/scripts/deploy_windows_winrm.py
@@ -0,0 +1,117 @@
+#!/usr/bin/env python3
+import base64
+import os
+import pathlib
+import sys
+import uuid
+
+import winrm
+
+
+def require_env(name: str) -> str:
+    value = os.getenv(name, "").strip()
+    if not value:
+        raise SystemExit(f"Missing required environment variable: {name}")
+    return value
+
+
+def optional_env(name: str, default: str) -> str:
+    value = os.getenv(name, "").strip()
+    return value if value else default
+
+
+def ps_quote(value: str) -> str:
+    return value.replace("'", "''")
+
+
+def main() -> int:
+    host = require_env("KK_DEPLOY_HOST")
+    port = optional_env("KK_DEPLOY_PORT", "5985")
+    username = require_env("KK_DEPLOY_USERNAME")
+    password = require_env("KK_DEPLOY_PASSWORD")
+    env_pairs = {
+        "KK_DEPLOY_ROOT": optional_env("KK_DEPLOY_ROOT", r"C:\kkFileView-5.0"),
+        "KK_DEPLOY_HEALTH_URL": optional_env("KK_DEPLOY_HEALTH_URL", "http://127.0.0.1:8012/"),
+        "KK_DEPLOY_REPO_URL": optional_env("KK_DEPLOY_REPO_URL", "https://github.com/kekingcn/kkFileView.git"),
+        "KK_DEPLOY_BRANCH": optional_env("KK_DEPLOY_BRANCH", "master"),
+        "KK_DEPLOY_SOURCE_ROOT": optional_env("KK_DEPLOY_SOURCE_ROOT", r"C:\kkFileView-source"),
+        "KK_DEPLOY_JAVA_HOME": optional_env("KK_DEPLOY_JAVA_HOME", r"C:\Program Files\jdk-21.0.2"),
+        "KK_DEPLOY_GIT_EXE": optional_env("KK_DEPLOY_GIT_EXE", r"C:\kkFileView-tools\git\cmd\git.exe"),
+        "KK_DEPLOY_MVN_CMD": optional_env("KK_DEPLOY_MVN_CMD", r"C:\kkFileView-tools\maven\bin\mvn.cmd"),
+        "KK_DEPLOY_MAVEN_SETTINGS": optional_env("KK_DEPLOY_MAVEN_SETTINGS", ""),
+        "KK_DEPLOY_DRY_RUN": optional_env("KK_DEPLOY_DRY_RUN", "false").lower(),
+    }
+
+    script_path = pathlib.Path(__file__).with_name("remote_windows_deploy.ps1")
+    script_body = script_path.read_text(encoding="utf-8")
+    payload = script_body.encode("utf-8-sig")
+    payload_b64 = base64.b64encode(payload).decode("ascii")
+
+    endpoint = f"http://{host}:{port}/wsman"
+    session = winrm.Session(endpoint, auth=(username, password), transport="ntlm")
+
+    suffix = uuid.uuid4().hex
+    remote_b64_path = fr"C:\Windows\Temp\kkfileview_deploy_{suffix}.b64"
+    remote_ps1_path = fr"C:\Windows\Temp\kkfileview_deploy_{suffix}.ps1"
+
+    prep = session.run_ps(
+        f"""
+$ErrorActionPreference = 'Stop'
+if (Test-Path '{ps_quote(remote_b64_path)}') {{ Remove-Item '{ps_quote(remote_b64_path)}' -Force }}
+if (Test-Path '{ps_quote(remote_ps1_path)}') {{ Remove-Item '{ps_quote(remote_ps1_path)}' -Force }}
+New-Item -ItemType File -Path '{ps_quote(remote_b64_path)}' -Force | Out-Null
+"""
+    )
+    if prep.status_code != 0:
+        sys.stderr.write(prep.std_err.decode("utf-8", errors="ignore"))
+        return prep.status_code
+
+    chunk_size = 1200
+    for start in range(0, len(payload_b64), chunk_size):
+        chunk = payload_b64[start : start + chunk_size]
+        append = session.run_ps(
+            f"Add-Content -LiteralPath '{ps_quote(remote_b64_path)}' -Value '{chunk}'"
+        )
+        if append.status_code != 0:
+            sys.stderr.write(append.std_err.decode("utf-8", errors="ignore"))
+            return append.status_code
+
+    result = session.run_ps(
+        f"""
+$ErrorActionPreference = 'Stop'
+$raw = Get-Content -LiteralPath '{ps_quote(remote_b64_path)}' -Raw
+[System.IO.File]::WriteAllBytes('{ps_quote(remote_ps1_path)}', [Convert]::FromBase64String($raw))
+try {{
+"""
+        + "\n".join(
+            f"  $env:{key} = '{ps_quote(value)}'" for key, value in env_pairs.items()
+        )
+        + f"""
+  powershell -NoProfile -ExecutionPolicy Bypass -File '{ps_quote(remote_ps1_path)}' `
+  $code = $LASTEXITCODE
+}} finally {{
+"""
+        + "\n".join(
+            f"  Remove-Item Env:{key} -ErrorAction SilentlyContinue" for key in env_pairs
+        )
+        + f"""
+  Remove-Item '{ps_quote(remote_b64_path)}' -Force -ErrorAction SilentlyContinue
+  Remove-Item '{ps_quote(remote_ps1_path)}' -Force -ErrorAction SilentlyContinue
+}}
+exit $code
+"""
+    )
+
+    stdout = result.std_out.decode("utf-8", errors="ignore").strip()
+    stderr = result.std_err.decode("utf-8", errors="ignore").strip()
+
+    if stdout:
+        print(stdout)
+    if stderr:
+        print(stderr, file=sys.stderr)
+
+    return result.status_code
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
--- a/.github/scripts/remote_windows_deploy.ps1
+++ b/.github/scripts/remote_windows_deploy.ps1
@@ -0,0 +1,327 @@
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+
+function Write-Step {
+    param([string]$Message)
+    Write-Host "==> $Message"
+}
+
+function Get-RequiredEnv {
+    param([string]$Name)
+
+    $Value = [Environment]::GetEnvironmentVariable($Name)
+    if ([string]::IsNullOrWhiteSpace($Value)) {
+        throw "Missing required environment variable: $Name"
+    }
+
+    return $Value
+}
+
+function Get-OptionalEnv {
+    param(
+        [string]$Name,
+        [string]$DefaultValue
+    )
+
+    $Value = [Environment]::GetEnvironmentVariable($Name)
+    if ([string]::IsNullOrWhiteSpace($Value)) {
+        return $DefaultValue
+    }
+
+    return $Value
+}
+
+$DeployRoot = Get-OptionalEnv 'KK_DEPLOY_ROOT' 'C:\kkFileView-5.0'
+$HealthUrl = Get-OptionalEnv 'KK_DEPLOY_HEALTH_URL' 'http://127.0.0.1:8012/'
+$RepoUrl = Get-OptionalEnv 'KK_DEPLOY_REPO_URL' 'https://github.com/kekingcn/kkFileView.git'
+$Branch = Get-OptionalEnv 'KK_DEPLOY_BRANCH' 'master'
+$SourceRoot = Get-OptionalEnv 'KK_DEPLOY_SOURCE_ROOT' 'C:\kkFileView-source'
+$JavaHome = Get-OptionalEnv 'KK_DEPLOY_JAVA_HOME' 'C:\Program Files\jdk-21.0.2'
+$GitExe = Get-OptionalEnv 'KK_DEPLOY_GIT_EXE' 'C:\kkFileView-tools\git\cmd\git.exe'
+$MvnCmd = Get-OptionalEnv 'KK_DEPLOY_MVN_CMD' 'C:\kkFileView-tools\maven\bin\mvn.cmd'
+$MavenSettings = Get-OptionalEnv 'KK_DEPLOY_MAVEN_SETTINGS' ''
+$DryRun = Get-OptionalEnv 'KK_DEPLOY_DRY_RUN' 'false'
+
+$BinDir = Join-Path $DeployRoot 'bin'
+$StartupScript = Join-Path $BinDir 'startup.bat'
+$ReleaseDir = Join-Path $DeployRoot 'releases'
+$DeployTmp = Join-Path $DeployRoot 'deploy-tmp'
+$BuildOutputDir = Join-Path (Join-Path $SourceRoot 'server') 'target'
+
+if (-not (Test-Path $DeployRoot)) {
+    throw "Deploy root not found: $DeployRoot"
+}
+
+if (-not (Test-Path $BinDir)) {
+    throw "Bin directory not found: $BinDir"
+}
+
+if (-not (Test-Path $StartupScript)) {
+    throw "Startup script not found: $StartupScript"
+}
+
+$CurrentJar = Get-ChildItem $BinDir -Filter 'kkFileView-*.jar' | Sort-Object LastWriteTime -Descending | Select-Object -First 1
+if (-not $CurrentJar) {
+    throw "No kkFileView jar found in $BinDir"
+}
+
+$JavaExe = Join-Path $JavaHome 'bin\java.exe'
+if (-not (Test-Path $JavaExe)) {
+    throw "JDK 21 java executable not found: $JavaExe"
+}
+
+if (-not (Test-Path $GitExe)) {
+    throw "Git executable not found: $GitExe"
+}
+
+if (-not (Test-Path $MvnCmd)) {
+    throw "Maven executable not found: $MvnCmd"
+}
+
+if (-not [string]::IsNullOrWhiteSpace($MavenSettings) -and -not (Test-Path $MavenSettings)) {
+    throw "Maven settings file not found: $MavenSettings"
+}
+
+$JarName = $CurrentJar.Name
+$JarPath = $CurrentJar.FullName
+
+Write-Step "Deploy root: $DeployRoot"
+Write-Step "Current jar: $JarPath"
+Write-Step "Startup script: $StartupScript"
+Write-Step "Health url: $HealthUrl"
+Write-Step "Source root: $SourceRoot"
+Write-Step "Branch: $Branch"
+Write-Step "Git exe: $GitExe"
+Write-Step "Maven cmd: $MvnCmd"
+Write-Step "Java home: $JavaHome"
+if (-not [string]::IsNullOrWhiteSpace($MavenSettings)) {
+    Write-Step "Maven settings: $MavenSettings"
+}
+
+function Invoke-External {
+    param(
+        [string]$FilePath,
+        [string[]]$Arguments,
+        [string]$WorkingDirectory = $null
+    )
+
+    $previous = $null
+    if ($WorkingDirectory) {
+        $previous = Get-Location
+        Set-Location $WorkingDirectory
+    }
+
+    try {
+        & $FilePath @Arguments
+        if ($LASTEXITCODE -ne 0) {
+            throw "Command failed ($LASTEXITCODE): $FilePath $($Arguments -join ' ')"
+        }
+    } finally {
+        if ($previous) {
+            Set-Location $previous
+        }
+    }
+}
+
+function Assert-SafeSourceRoot {
+    param([string]$PathToCheck)
+
+    $FullPath = [System.IO.Path]::GetFullPath($PathToCheck)
+    $RootPath = [System.IO.Path]::GetPathRoot($FullPath)
+    if ($FullPath.TrimEnd('\') -eq $RootPath.TrimEnd('\')) {
+        throw "Refusing to use drive root as source root: $FullPath"
+    }
+
+    $DangerousLeafNames = @(
+        'Windows',
+        'Users',
+        'Program Files',
+        'Program Files (x86)',
+        'ProgramData'
+    )
+    $LeafName = Split-Path -Leaf $FullPath.TrimEnd('\')
+    if ($DangerousLeafNames -contains $LeafName) {
+        throw "Refusing to use a high-risk source root path: $FullPath"
+    }
+}
+
+$env:JAVA_HOME = $JavaHome
+$env:Path = (Join-Path $JavaHome 'bin') + ';' + (Split-Path -Parent $GitExe) + ';' + (Split-Path -Parent $MvnCmd) + ';' + $env:Path
+
+Write-Step 'Validating Git executable'
+Invoke-External -FilePath $GitExe -Arguments @('--version')
+
+Write-Step 'Validating Maven executable'
+$MavenVersionArgs = @('-version')
+if (-not [string]::IsNullOrWhiteSpace($MavenSettings)) {
+    $MavenVersionArgs = @('-s', $MavenSettings, '-version')
+}
+Invoke-External -FilePath $MvnCmd -Arguments $MavenVersionArgs
+
+if ($DryRun -eq 'true') {
+    Write-Step "Dry run enabled, remote validation finished"
+    return
+}
+
+New-Item -ItemType Directory -Force -Path $ReleaseDir | Out-Null
+New-Item -ItemType Directory -Force -Path $DeployTmp | Out-Null
+
+function Sync-Repository {
+    Assert-SafeSourceRoot -PathToCheck $SourceRoot
+
+    if (-not (Test-Path (Join-Path $SourceRoot '.git'))) {
+        if (Test-Path $SourceRoot) {
+            Remove-Item $SourceRoot -Recurse -Force
+        }
+
+        $parent = Split-Path -Parent $SourceRoot
+        if ($parent) {
+            New-Item -ItemType Directory -Force -Path $parent | Out-Null
+        }
+
+        Write-Step "Cloning repository from $RepoUrl"
+        Invoke-External -FilePath $GitExe -Arguments @('clone', '--depth', '1', '--branch', $Branch, '--single-branch', $RepoUrl, $SourceRoot)
+        return
+    }
+
+    Write-Step "Fetching latest branch state from origin/$Branch"
+    Invoke-External -FilePath $GitExe -Arguments @('remote', 'set-url', 'origin', $RepoUrl) -WorkingDirectory $SourceRoot
+    Invoke-External -FilePath $GitExe -Arguments @('fetch', '--prune', '--depth', '1', 'origin', $Branch) -WorkingDirectory $SourceRoot
+    Invoke-External -FilePath $GitExe -Arguments @('checkout', '-B', $Branch, "origin/$Branch") -WorkingDirectory $SourceRoot
+    Invoke-External -FilePath $GitExe -Arguments @('reset', '--hard', "origin/$Branch") -WorkingDirectory $SourceRoot
+    Invoke-External -FilePath $GitExe -Arguments @('clean', '-fd') -WorkingDirectory $SourceRoot
+}
+
+function Build-KkFileView {
+    Write-Step 'Building kkFileView from source'
+    $BuildArgs = @('-B', 'clean', 'package', '-Dmaven.test.skip=true', '--file', 'pom.xml')
+    if (-not [string]::IsNullOrWhiteSpace($MavenSettings)) {
+        $BuildArgs = @('-s', $MavenSettings) + $BuildArgs
+    }
+    Invoke-External -FilePath $MvnCmd -Arguments $BuildArgs -WorkingDirectory $SourceRoot
+}
+
+Sync-Repository
+Build-KkFileView
+
+$DownloadedJars = Get-ChildItem $BuildOutputDir -Filter 'kkFileView-*.jar' -File
+if (-not $DownloadedJars) {
+    throw "No kkFileView jar found in build output: $BuildOutputDir"
+}
+
+if ($DownloadedJars.Count -ne 1) {
+    throw "Expected exactly one kkFileView jar in build output, found $($DownloadedJars.Count)"
+}
+
+$DownloadedJar = $DownloadedJars[0]
+
+$Timestamp = Get-Date -Format 'yyyyMMddHHmmss'
+$BackupJar = Join-Path $ReleaseDir ("{0}.{1}.bak" -f $JarName, $Timestamp)
+
+function Stop-KkFileView {
+    foreach ($Process in @(Get-KkFileViewJavaProcesses) + @(Get-KkFileViewLauncherProcesses)) {
+        Write-Step "Stopping process $($Process.ProcessId)"
+        Stop-Process -Id $Process.ProcessId -Force -ErrorAction SilentlyContinue
+    }
+}
+
+function Get-KkFileViewJavaProcesses {
+    $JarPattern = [regex]::Escape($JarName)
+    return Get-CimInstance Win32_Process | Where-Object {
+        $_.Name -match '^java(\.exe)?$' -and $_.CommandLine -and $_.CommandLine -match $JarPattern
+    }
+}
+
+function Get-KkFileViewLauncherProcesses {
+    $StartupPattern = [regex]::Escape([System.IO.Path]::GetFileName($StartupScript))
+    return Get-CimInstance Win32_Process | Where-Object {
+        $_.Name -ieq 'cmd.exe' -and $_.CommandLine -and $_.CommandLine -match $StartupPattern
+    }
+}
+
+function Wait-KkFileViewStopped {
+    param([int]$TimeoutSeconds = 30)
+
+    for ($i = 0; $i -lt $TimeoutSeconds; $i++) {
+        $JavaProcesses = @(Get-KkFileViewJavaProcesses)
+        $CmdProcesses = @(Get-KkFileViewLauncherProcesses)
+        if ((@($JavaProcesses).Count + @($CmdProcesses).Count) -eq 0) {
+            return $true
+        }
+
+        Start-Sleep -Seconds 1
+    }
+
+    return $false
+}
+
+function Start-KkFileView {
+    Write-Step "Starting kkFileView"
+    $CreateResult = Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{
+        CommandLine = ('cmd.exe /c ""' + $StartupScript + '""')
+        CurrentDirectory = $BinDir
+    }
+
+    if ($CreateResult.ReturnValue -ne 0) {
+        throw "Failed to start kkFileView launcher, Win32_Process.Create returned $($CreateResult.ReturnValue)"
+    }
+
+    Write-Step "Launcher process created with pid $($CreateResult.ProcessId)"
+}
+
+function Wait-Health {
+    param([string]$Url)
+
+    $SuccessfulChecks = 0
+    for ($i = 0; $i -lt 24; $i++) {
+        Start-Sleep -Seconds 5
+        try {
+            $Response = Invoke-WebRequest -Uri $Url -UseBasicParsing -TimeoutSec 5
+            if ($Response.StatusCode -eq 200 -and @(Get-KkFileViewJavaProcesses).Count -gt 0) {
+                $SuccessfulChecks++
+            } else {
+                $SuccessfulChecks = 0
+            }
+
+            if ($SuccessfulChecks -ge 3) {
+                return $true
+            }
+        } catch {
+            $SuccessfulChecks = 0
+            Start-Sleep -Milliseconds 200
+        }
+    }
+
+    return $false
+}
+
+Write-Step "Backing up current jar to $BackupJar"
+Copy-Item $JarPath $BackupJar -Force
+
+Stop-KkFileView
+if (-not (Wait-KkFileViewStopped)) {
+    throw "Timed out waiting for the previous kkFileView process to exit"
+}
+
+Write-Step "Replacing jar with artifact output"
+Copy-Item $DownloadedJar.FullName $JarPath -Force
+
+Start-KkFileView
+
+if (-not (Wait-Health -Url $HealthUrl)) {
+    Write-Step "Health check failed, rolling back"
+    Stop-KkFileView
+    if (-not (Wait-KkFileViewStopped)) {
+        throw "Timed out waiting for the failed kkFileView process to exit during rollback"
+    }
+    Copy-Item $BackupJar $JarPath -Force
+    Start-KkFileView
+
+    if (-not (Wait-Health -Url $HealthUrl)) {
+        throw "Deployment failed and rollback health check also failed"
+    }
+
+    throw "Deployment failed, rollback completed successfully"
+}
+
+Write-Step "Deployment completed successfully"
--- a/.github/workflows/master-auto-deploy.yml
+++ b/.github/workflows/master-auto-deploy.yml
@@ -0,0 +1,52 @@
+name: Master Auto Deploy
+
+on:
+  push:
+    branches: [ master ]
+  workflow_dispatch:
+
+concurrency:
+  group: master-auto-deploy-production
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  deploy-windows:
+    runs-on: ubuntu-22.04
+    env:
+      KK_DEPLOY_HOST: ${{ secrets.KK_DEPLOY_HOST }}
+      KK_DEPLOY_PORT: ${{ secrets.KK_DEPLOY_PORT }}
+      KK_DEPLOY_USERNAME: ${{ secrets.KK_DEPLOY_USERNAME }}
+      KK_DEPLOY_PASSWORD: ${{ secrets.KK_DEPLOY_PASSWORD }}
+      KK_DEPLOY_ROOT: ${{ secrets.KK_DEPLOY_ROOT }}
+      KK_DEPLOY_HEALTH_URL: ${{ secrets.KK_DEPLOY_HEALTH_URL }}
+      KK_DEPLOY_REPO_URL: ${{ vars.KK_DEPLOY_REPO_URL }}
+      KK_DEPLOY_BRANCH: ${{ vars.KK_DEPLOY_BRANCH }}
+      KK_DEPLOY_SOURCE_ROOT: ${{ vars.KK_DEPLOY_SOURCE_ROOT }}
+      KK_DEPLOY_JAVA_HOME: ${{ vars.KK_DEPLOY_JAVA_HOME }}
+      KK_DEPLOY_GIT_EXE: ${{ vars.KK_DEPLOY_GIT_EXE }}
+      KK_DEPLOY_MVN_CMD: ${{ vars.KK_DEPLOY_MVN_CMD }}
+      KK_DEPLOY_MAVEN_SETTINGS: ${{ vars.KK_DEPLOY_MAVEN_SETTINGS }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install WinRM dependencies
+        run: pip install pywinrm
+
+      - name: Validate deploy secrets
+        run: |
+          test -n "$KK_DEPLOY_HOST" || (echo "Missing secret: KK_DEPLOY_HOST" && exit 1)
+          test -n "$KK_DEPLOY_USERNAME" || (echo "Missing secret: KK_DEPLOY_USERNAME" && exit 1)
+          test -n "$KK_DEPLOY_PASSWORD" || (echo "Missing secret: KK_DEPLOY_PASSWORD" && exit 1)
+
+      - name: Deploy to Windows server
+        run: python .github/scripts/deploy_windows_winrm.py
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -11,7 +11,7 @@ on:

 jobs:
  build:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ matrix.os }}

    steps:
    - name: Checkout repository
@@ -33,10 +33,10 @@ jobs:
          ${{ runner.os }}-maven-

    - name: Build with Maven
-      run: mvn -B package -Dmaven.test.skip=true --file pom.xml
+      run: mvn -B package "-Dmaven.test.skip=true" --file pom.xml

    - name: Upload Linux distribution package
-      if: success()
+      if: success() && runner.os == 'Linux'
      uses: actions/upload-artifact@v4
      with:
        name: kkfileview-linux
@@ -44,9 +44,12 @@ jobs:
        retention-days: 7

    - name: Upload Windows distribution package
-      if: success()
+      if: success() && runner.os == 'Windows'
      uses: actions/upload-artifact@v4
      with:
        name: kkfileview-windows
        path: server/target/*.zip
        retention-days: 7
+    strategy:
+      matrix:
+        os: [ ubuntu-latest, windows-latest, macos-latest ]
--- a/.gitignore
+++ b/.gitignore
@@ -26,6 +26,7 @@ nbdist/
 ### VS Code ###
 .vscode/
 .DS_Store
+.artifacts/

 server/src/main/cache/
 server/src/main/file/
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -0,0 +1,230 @@
+# AGENTS.md
+
+This document is for coding agents and automation tools working in this repository.
+
+## Project Overview
+
+- Project: `kkFileView`
+- Stack: Spring Boot + Freemarker + Redis/Redisson (optional) + JODConverter + front-end preview pages
+- Main module: `server`
+- Default local URL: `http://127.0.0.1:8012/`
+- Production demo: `https://file.kkview.cn/`
+
+This repository is a document preview service. Most user-facing work falls into one of these areas:
+
+1. preview routing and file-type dispatch
+2. conversion pipelines for Office / PDF / CAD / archives / images
+3. Freemarker preview templates under `server/src/main/resources/web`
+4. CI, E2E fixtures, and production deployment automation
+
+## Repository Layout
+
+- `server/`
+  Main application code, templates, config, packaged artifacts
+- `server/src/main/java/cn/keking/`
+  Core Java application code
+- `server/src/main/resources/web/`
+  Freemarker preview templates
+- `server/src/main/resources/static/`
+  Front-end static assets used by preview pages
+- `server/src/main/config/`
+  Main runtime config files
+- `server/src/main/bin/`
+  Local startup/dev scripts
+- `tests/e2e/`
+  Playwright-based end-to-end tests and fixtures
+- `.github/workflows/`
+  CI and deployment workflows
+- `.github/scripts/`
+  Windows production deployment scripts over WinRM
+
+## Key Entry Points
+
+- App entry:
+  - `server/src/main/java/cn/keking/ServerMain.java`
+- Preview controller:
+  - `server/src/main/java/cn/keking/web/controller/OnlinePreviewController.java`
+- File attribute parsing / request handling:
+  - `server/src/main/java/cn/keking/service/FileHandlerService.java`
+- Office preview flow:
+  - `server/src/main/java/cn/keking/service/impl/OfficeFilePreviewImpl.java`
+- PDF preview flow:
+  - `server/src/main/java/cn/keking/service/impl/PdfFilePreviewImpl.java`
+- Archive extraction:
+  - `server/src/main/java/cn/keking/service/CompressFileReader.java`
+
+## Important Templates
+
+- `server/src/main/resources/web/compress.ftl`
+  Archive directory/tree preview page
+- `server/src/main/resources/web/pdf.ftl`
+  PDF preview container page
+- `server/src/main/resources/web/picture.ftl`
+  Single image preview page
+- `server/src/main/resources/web/officePicture.ftl`
+  Office/PDF image-mode preview page
+- `server/src/main/resources/web/officeweb.ftl`
+  Front-end xlsx/html preview page
+
+When debugging UX issues, inspect the exact template selected by the preview flow first. Do not assume two similar preview pages share the same CSS or behavior.
+
+## Local Development
+
+### Recommended dev mode
+
+Use:
+
+```bash
+./server/src/main/bin/dev.sh
+```
+
+This runs Spring Boot with resource hot reload using:
+
+- `spring-boot:run`
+- `-Dspring-boot.run.addResources=true`
+- `server/src/main/config/application.properties`
+
+For front-end template or CSS/JS edits, prefer `dev.sh` over rebuilding jars repeatedly.
+
+### Jar build
+
+```bash
+mvn -q -pl server -DskipTests package
+```
+
+### Main test command used in CI
+
+```bash
+mvn -B package -Dmaven.test.skip=true --file pom.xml
+```
+
+## Configuration Notes
+
+Primary runtime config used by the scripts and defaults committed in this repository:
+
+- `server/src/main/config/application.properties`
+
+Optional environment-specific config:
+
+- `server/src/main/config/test.properties`
+
+Be careful: the repository defaults point at `application.properties`. If a deployment environment explicitly starts the app with `test.properties`, treat that as an environment-specific override rather than the repository default. Always verify the actual startup command before assuming which config file is active.
+
+Examples of config that commonly affects behavior:
+
+- `office.preview.type`
+- `office.preview.switch.disabled`
+- `trust.host`
+- `not.trust.host`
+- `file.upload.disable`
+
+## Preview Behavior Notes
+
+- Office files can render in `pdf` mode or `image` mode.
+- PDF preview uses `pdf.ftl`.
+- Single images use `picture.ftl`.
+- Office image-mode previews use `officePicture.ftl`.
+- Archive previews are not simple file lists; they can load nested previews via the archive UI in `compress.ftl`.
+
+When changing preview defaults, verify both:
+
+1. server-side default config
+2. front-end mode-switch links/buttons
+
+## Archive Preview Notes
+
+Archive preview is a sensitive area because it combines:
+
+- directory tree generation
+- extraction to disk
+- nested preview URL construction
+- inline iframe loading
+
+If an archive-contained Office file gets stuck on loading:
+
+1. verify the extracted file on disk is not corrupted
+2. verify conversion output exists
+3. verify the preview template points to the correct generated artifact
+4. verify the running Office manager / LibreOffice process is healthy
+
+Do not assume “loading forever” is a front-end issue.
+
+## Testing
+
+### Targeted Java tests
+
+Example targeted test:
+
+```bash
+mvn -q -pl server -Dtest=PdfViewerCompatibilityTests test
+```
+
+### E2E tests
+
+See:
+
+- `tests/e2e/README.md`
+
+PR E2E currently covers:
+
+- common preview smoke tests
+- Office smoke tests
+- archive smoke tests
+- basic security and performance checks
+
+## CI / Deployment
+
+### CI
+
+- `maven.yml`
+  - builds on `push` to `master`
+  - builds on PRs targeting `master`
+- `pr-e2e-mvp.yml`
+  - runs E2E on PRs to `master`
+
+### Production deployment
+
+- `master-auto-deploy.yml`
+  - triggers on push to `master`
+  - deploys to Windows over WinRM
+
+Deployment script:
+
+- `.github/scripts/remote_windows_deploy.ps1`
+
+Important operational detail:
+
+- the committed `bin/startup.bat` in this repo points at `..\config\application.properties`
+- if production uses a different config file, treat that as an out-of-repo server override rather than a repository default
+
+If a production config change “does not take effect”, inspect the actual startup command or deployed `startup.bat` on the server first and verify which config file path it is using.
+
+## Working Conventions For Agents
+
+- Prefer minimal, targeted changes over wide refactors.
+- Inspect the active preview template before editing CSS.
+- Verify whether behavior is controlled by config, back-end routing, or front-end template logic before changing code.
+- For production/debug tasks, distinguish clearly between:
+  - repository source defaults
+  - deployed server config
+  - runtime process arguments
+- When changing defaults, mention whether the change affects:
+  - local dev only
+  - repository default config
+  - deployed server config
+  - existing query-param overrides
+
+## Suggested Validation Checklist
+
+For preview-related changes, validate as many of these as apply:
+
+1. target URL returns `200`
+2. selected template is the expected one
+3. generated intermediate artifacts exist when required
+4. target UI element or style change is actually present in rendered HTML
+5. targeted Java test passes
+6. relevant E2E path is still compatible
+
+## Non-Goals
+
+This file is not a replacement for user-facing product documentation. Keep it focused on helping coding agents navigate the codebase and make correct changes faster.
--- a/6
+++ b/6
@@ -1,4 +1,4 @@
-FROM keking/kkfileview-base:4.4.0
+FROM keking/kkfileview-base:5.0.0
 ADD server/target/kkFileView-*.tar.gz /opt/
-ENV KKFILEVIEW_BIN_FOLDER=/opt/kkFileView-4.4.0/bin
-ENTRYPOINT ["java","-Dfile.encoding=UTF-8","-Dspring.config.location=/opt/kkFileView-4.4.0/config/application.properties","-jar","/opt/kkFileView-4.4.0/bin/kkFileView-4.4.0.jar"]
+ENV KKFILEVIEW_BIN_FOLDER=/opt/kkFileView-5.0.2/bin
+ENTRYPOINT ["java","-Dfile.encoding=UTF-8","-Dspring.config.location=/opt/kkFileView-5.0.2/config/application.properties","-jar","/opt/kkFileView-5.0.2/bin/kkFileView-5.0.2.jar"]
--- a/README.cn.md
+++ b/README.cn.md
@@ -149,7 +149,45 @@ pdf预览模式预览效果如下

 ### 历史更新记录

-#### > 2026年01月20日，v5.0 版本发布 ：
+#### > 2026年08月14日，v5.0.2 补丁版本发布 ：
+
+#### 安全修复
+1. 将不可信 HTML 预览放入不具有同源权限的 iframe 沙箱，并默认禁用其中的 JavaScript，避免被预览文件在 kkFileView 应用源中执行脚本（GHSA-9wcf-jxxf-w2g2）
+2. 默认禁用演示文件删除接口，将接口改为 POST，并要求显式配置密码后进行精确比较（GHSA-f3qx-xrwc-5428）
+
+#### 修复问题
+1. 在 PDF 转图服务启动时刷新 ImageIO 插件，使 JBIG2 等嵌套 JAR 图像读取器能够被发现，避免 PDF 转图片预览时部分图像丢失
+
+#### 升级说明
+1. 建议所有 v5.0.1 及更早版本用户尽快升级到 v5.0.2
+2. 本版本继续要求 JDK 21 及以上，现有 v5.0.1 配置可直接沿用
+3. 文件删除功能现在默认禁用；如确需启用，请通过 `KK_DELETE_PASSWORD` 或外部 `delete.password` 设置独立强密码，并将 `/deleteFile` 调用改为 POST
+4. `kk.scriptjs` 现在默认为 `false`；显式启用后，脚本仍只会在隔离的 iframe 沙箱内运行
+
+#### > 2026年07月13日，v5.0.1 补丁版本发布 ：
+
+#### 安全修复
+1. 修复 `/addTask` 未经过信任主机和本地目录过滤，可能导致服务端请求伪造（SSRF）的问题（GHSA-gwwj-52hv-6g2m）
+2. 修复 `/listFiles` 的 `directory` 参数可越出演示目录，造成路径遍历和目录信息泄露的问题（GHSA-pmp8-g8p2-p6jq）
+
+#### 修复问题
+1. 修复 PDF 跨域、页码定位、文本高亮、打印和打印水印相关问题
+2. 修复 PDF 在反向代理场景下的绝对路径问题，以及水印和高亮内容包含特殊字符时的解析失败
+3. 修复 Redis 单机、集群、主从、哨兵模式配置不一致和地址协议缺失问题
+4. 修复下载 MIME 类型校验失败后仍返回成功、HTTP 错误原因不明确，以及共享 HTTP Client 被错误关闭的问题
+5. 修复 LuckyExcel 数据校验类型未映射时的 xlsx 解析崩溃
+
+#### 优化内容
+1. 大型 xlsx 文件改用 Web Worker 执行 LuckyExcel 解析，并在 Worker 不可用或异常时自动回退主线程
+2. 新增 `pdf.sidebar.open` 配置，可控制 PDF 预览是否默认打开侧栏
+3. Maven CI 增加 Linux、Windows、macOS 构建验证
+4. 新增仓库安全策略和私密漏洞报告入口
+
+#### 升级说明
+1. 建议所有 v5.0.0 及更早版本用户尽快升级到 v5.0.1
+2. 本版本继续要求 JDK 21 及以上，现有 v5.0.0 配置可直接沿用
+
+#### > 2026年04月14日，v5.0.0 版本发布 ：
 #### 优化内容
 1. xlsx 前端解析优化 - 提升Excel文件前端渲染性能
 2. 图片解析优化 - 改进图片处理机制
@@ -159,6 +197,10 @@ pdf预览模式预览效果如下
 6. ftp多客户端接入优化 - 提升FTP服务兼容性
 7. 首页目录访问优化 - 采用post服务端分页机制
 8. marked 解析优化 - 改进Markdown渲染
+9. 压缩包预览页重构为单工作区布局，支持目录折叠与右侧内嵌预览
+10. 优化压缩包内文件类型标识，以及单图预览页的展示样式
+11. 补充面向工程自动化与编码代理的仓库说明文档
+12. 重构演示门户页面，包括首页、接入说明、版本记录与赞助页

 #### 新增功能
 1. msg邮件解析 - 新增msg格式邮件文件预览支持
@@ -179,6 +221,12 @@ pdf预览模式预览效果如下
 2. 安全问题 - 修复安全漏洞
 3. 图片水印不全问题 - 修复水印显示不完整
 4. SSL自签证书接入问题 - 修复自签名证书兼容性
+5. 修复压缩包内 Office 文件在重复解压后被追加写坏，导致一直卡在加载中的问题
+6. Office 默认预览改为 PDF 模式，且 PDF 预览默认打开缩略图侧栏
+7. 启动脚本改为自动发现当前发布包中的 jar，移除过时的硬编码 jar 名称
+8. 更新 Docker 与发布辅助文档，使其与 5.0.0 发布线保持一致
+9. 修复 OFD 表格竖线溢出导致的渲染异常
+10. 修复 PDF.js 兼容性补丁，避免兼容环境下的预览报错

 #### 更新内容
 1. JDK版本要求 - 强制要求JDK 21及以上版本
@@ -189,6 +237,8 @@ pdf预览模式预览效果如下
 6. tif后端异步转换优化 - 实现多线程异步转换
 7. 视频后端异步转换优化 - 实现多线程异步转换
 8. CAD后端异步转换优化 - 实现多线程异步转换
+9. 默认预览配置策略调整 - Office 预览默认切换为 PDF 模式，默认隐藏图片/PDF 模式切换按钮，且 PDF 预览默认展开缩略图侧栏。若升级后仍需保持旧的图片优先体验，请显式设置 `office.preview.type=image` 和 `office.preview.switch.disabled=false`。
+10. 信任域名配置匹配策略扩展 - `trust.host` 及相关规则现已支持通配符和 CIDR 匹配，升级后如果你依赖域名/IP 模式匹配，需要重新检查白名单和黑名单的实际生效范围

 #### > 2025年01月16日，v4.4.0 版本发布 ：

@@ -468,4 +518,3 @@ dcm医疗数位影像  引用于 [dcmjs](https://github.com/dcmjs-org/dcmjs )开
 - 本项目诞生于[凯京集团]，在取得公司高层同意后以 Apache 协议开源出来反哺社区，在此特别感谢凯京集团，以及集团领导[@唐老大](https://github.com/tangshd)的支持、@端木详笑的贡献。
 - 本项目已脱离公司由[KK开源社区]维护发展壮大，感谢所有给 kkFileView 提 Issue 、Pr 开发者
 - 本项目引入的第三方组件已在 '关于引用' 列表列出，感谢这些项目，让 kkFileView 更出色
-
--- a/README.md
+++ b/README.md
@@ -65,9 +65,47 @@ URL：[https://file.kkview.cn](https://file.kkview.cn)

 ## Change History

-### Version 5.0 (January 20, 2026)
+### Version 5.0.2 (August 14, 2026)

-#### Optimizations
+#### Security Fixes
+1. Sandboxed untrusted HTML previews in an opaque-origin iframe and disabled embedded JavaScript by default, preventing previewed files from executing in the kkFileView application origin (GHSA-9wcf-jxxf-w2g2)
+2. Disabled the demo file deletion endpoint by default, changed it to POST, and required an explicitly configured password with exact comparison (GHSA-f3qx-xrwc-5428)
+
+#### Fixes
+1. Refreshed ImageIO plugins when PDF conversion starts so nested JAR providers such as the JBIG2 reader are discovered, preventing images from disappearing in PDF-to-image previews
+
+#### Upgrade Notes
+1. All users running v5.0.1 or earlier are strongly encouraged to upgrade to v5.0.2
+2. JDK 21 or higher remains required, and existing v5.0.1 configuration can be reused
+3. File deletion is now disabled unless `KK_DELETE_PASSWORD` or an external `delete.password` is set to an independent strong password; integrations must call `/deleteFile` with POST
+4. `kk.scriptjs` now defaults to `false`; when explicitly enabled, scripts still run only inside the isolated iframe sandbox
+
+### Version 5.0.1 (July 13, 2026)
+
+#### Security Fixes
+1. Fixed `/addTask` bypassing trusted-host and local-directory filters, which could allow server-side request forgery (SSRF) (GHSA-gwwj-52hv-6g2m)
+2. Fixed the `/listFiles` `directory` parameter escaping the demo directory, which could allow path traversal and directory information disclosure (GHSA-pmp8-g8p2-p6jq)
+
+#### Fixes
+1. Fixed PDF cross-origin access, page positioning, text highlighting, printing, and print watermark issues
+2. Fixed PDF absolute paths behind reverse proxies and parsing failures when watermark or highlight text contains special characters
+3. Fixed inconsistent Redis settings across standalone, cluster, master-replica, and sentinel modes, including missing address protocols
+4. Fixed successful responses after MIME validation failures, unclear HTTP error reporting, and accidental closure of a shared HTTP client
+5. Fixed xlsx parsing crashes when LuckyExcel data-validation types have no mapping
+
+#### Improvements
+1. Moved LuckyExcel parsing for large xlsx files into a Web Worker, with automatic main-thread fallback when the Worker is unavailable or fails
+2. Added `pdf.sidebar.open` to control whether the PDF sidebar opens by default
+3. Added Linux, Windows, and macOS validation to Maven CI
+4. Added a repository security policy and private vulnerability reporting guidance
+
+#### Upgrade Notes
+1. All users running v5.0.0 or earlier are strongly encouraged to upgrade to v5.0.1
+2. JDK 21 or higher remains required, and existing v5.0.0 configuration can be reused
+
+### Version 5.0.0 (April 14, 2026)
+
+#### Improvements
 1. Enhanced xlsx front-end parsing - Improved Excel file front-end rendering performance
 2. Optimized image parsing - Enhanced image processing mechanism
 3. Improved tif parsing - Enhanced TIF format support
@@ -76,6 +114,10 @@ URL：[https://file.kkview.cn](https://file.kkview.cn)
 6. Optimized ftp multi-client access - Improved FTP service compatibility
 7. Enhanced home page directory access - Implemented post server-side pagination mechanism
 8. Improved marked parsing - Enhanced Markdown rendering
+9. Redesigned archive preview into a single workspace with a collapsible tree and inline file preview
+10. Improved archive preview file-type badges and single-image preview styling
+11. Added an agent-focused repository guide for engineering automation and maintenance
+12. Refreshed the demo portal pages, including the index, integration guide, release record, and sponsor pages

 #### New Features
 1. msg email parsing - Added support for msg format email file preview
@@ -96,6 +138,12 @@ URL：[https://file.kkview.cn](https://file.kkview.cn)
 2. Security issues - Fixed security vulnerabilities
 3. Incomplete image watermark issues - Fixed incomplete watermark display
 4. SSL self-signed certificate access issues - Fixed compatibility with self-signed certificates
+5. Fixed archive-contained Office files that could stay stuck on loading because repeated extraction appended to existing files
+6. Default Office preview now prefers PDF mode, and PDF preview opens with the thumbnail sidebar visible by default
+7. Updated startup scripts to discover the packaged jar dynamically instead of relying on stale hard-coded jar names
+8. Updated Docker and release helper docs to align with the 5.0.0 release line
+9. Fixed OFD table border overflow rendering issues
+10. Refined the PDF.js compatibility polyfill to avoid preview errors in compatibility environments

 #### Updates
 1. JDK version requirement - Mandatory requirement for JDK 21 or higher
@@ -106,6 +154,8 @@ URL：[https://file.kkview.cn](https://file.kkview.cn)
 6. tif backend async conversion optimization - Implemented multi-threaded asynchronous conversion
 7. Video backend async conversion optimization - Implemented multi-threaded asynchronous conversion
 8. CAD backend async conversion optimization - Implemented multi-threaded asynchronous conversion
+9. Default preview configuration strategy adjusted - Office preview now defaults to PDF mode, the mode switch is hidden by default, and PDF preview opens with the thumbnail sidebar visible. If you need the previous image-first behavior after upgrade, explicitly set `office.preview.type=image` and `office.preview.switch.disabled=false`.
+10. Trust host configuration matching expanded - `trust.host` and related rules now support wildcard and CIDR matching, which may broaden or narrow effective allow/deny behavior after upgrade depending on your patterns

 ### Version 4.4.0 (January 16, 2025)

--- a/SECURITY.md
+++ b/SECURITY.md
@@ -0,0 +1,66 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are handled for the latest released version of kkFileView and the
+current `master` branch. Older versions may be evaluated case by case, but users
+are encouraged to upgrade to the latest release before reporting or verifying a
+security issue.
+
+## Reporting a Vulnerability
+
+Please report security vulnerabilities privately through GitHub Private
+Vulnerability Reporting:
+
+https://github.com/kekingcn/kkFileView/security/advisories/new
+
+Do not publish vulnerability details, proof-of-concept code, exploit steps,
+sensitive logs, or private deployment information in public GitHub issues,
+discussions, pull requests, or comments.
+
+When reporting a vulnerability, please include as much of the following
+information as you can safely share:
+
+- Affected kkFileView version or commit
+- Deployment mode, operating system, JDK version, and related middleware
+- Clear reproduction steps
+- Impact assessment and affected feature or endpoint
+- Sanitized logs, screenshots, or sample files if they are required to reproduce
+  the issue
+- Whether the issue is already being disclosed elsewhere
+
+The maintainers will review private reports, ask for additional information when
+needed, coordinate a fix, and publish disclosure information when appropriate.
+
+If the private reporting link is unavailable, please open a public issue only to
+request a private contact channel, without including technical vulnerability
+details.
+
+---
+
+# 安全策略
+
+## 支持版本
+
+kkFileView 安全修复主要覆盖最新发布版本和当前 `master` 分支。旧版本问题会视影响范围和维护成本单独评估，但建议用户优先升级到最新版本后再验证或报告安全问题。
+
+## 报告安全漏洞
+
+请通过 GitHub Private Vulnerability Reporting 私密提交安全漏洞：
+
+https://github.com/kekingcn/kkFileView/security/advisories/new
+
+请不要在公开 GitHub issue、discussion、pull request 或评论中发布漏洞细节、PoC、利用步骤、敏感日志或私有部署信息。
+
+提交漏洞时，请在可安全分享的前提下尽量提供以下信息：
+
+- 受影响的 kkFileView 版本或提交
+- 部署方式、操作系统、JDK 版本和相关中间件信息
+- 清晰的复现步骤
+- 影响范围，以及受影响的功能或接口
+- 复现所需的脱敏日志、截图或样例文件
+- 该问题是否已在其他渠道披露
+
+维护者会在私密渠道中评估报告，在需要时继续确认细节，协调修复，并在适当时发布披露信息。
+
+如果私密报告链接不可用，请只在公开 issue 中请求私密联系方式，不要包含任何技术漏洞细节。
--- a/doc/ci-auto-deploy.md
+++ b/doc/ci-auto-deploy.md
@@ -0,0 +1,57 @@
+# kkFileView master 自动部署
+
+当前线上 Windows 服务器的实际部署信息如下：
+
+- 部署根目录：`C:\kkFileView-5.0`
+- 运行 jar：`C:\kkFileView-5.0\bin\kkFileView-<当前项目版本>.jar`
+- 启动脚本：`C:\kkFileView-5.0\bin\startup.bat`
+- 运行配置：`C:\kkFileView-5.0\config\test.properties`
+- 健康检查地址：`http://127.0.0.1:8012/`
+
+当前自动部署链路采用服务器拉最新源码并本机编译的方式：
+
+1. 通过 WinRM 连接 Windows 服务器
+2. 在服务器上的源码目录执行 `git fetch/reset/clean`，同步到 `origin/$KK_DEPLOY_BRANCH`（默认 `master`）
+3. 使用服务器上的 JDK 21 和 Maven 执行 `mvn clean package -Dmaven.test.skip=true`
+4. 备份线上 jar，替换为新构建产物
+5. 使用现有 `startup.bat` 重启，并做健康检查
+6. 如果健康检查失败，则自动回滚旧 jar 并重新拉起
+
+## 需要配置的 GitHub Secrets
+
+- `KK_DEPLOY_HOST`
+- `KK_DEPLOY_USERNAME`
+- `KK_DEPLOY_PASSWORD`
+
+以下部署参数当前由 workflow 从 GitHub Secrets 读取；如果未单独配置，则使用脚本默认值：
+
+- `KK_DEPLOY_PORT=5985`
+- `KK_DEPLOY_ROOT=C:\kkFileView-5.0`
+- `KK_DEPLOY_HEALTH_URL=http://127.0.0.1:8012/`
+
+下面这些非敏感参数可以通过 workflow env 或 GitHub Variables 覆盖；未配置时会使用默认值：
+- `KK_DEPLOY_REPO_URL=https://github.com/kekingcn/kkFileView.git`
+- `KK_DEPLOY_BRANCH=master`
+- `KK_DEPLOY_SOURCE_ROOT=C:\kkFileView-source`
+- `KK_DEPLOY_JAVA_HOME=C:\Program Files\jdk-21.0.2`
+- `KK_DEPLOY_GIT_EXE=C:\kkFileView-tools\git\cmd\git.exe`
+- `KK_DEPLOY_MVN_CMD=C:\kkFileView-tools\maven\bin\mvn.cmd`
+- `KK_DEPLOY_MAVEN_SETTINGS=`
+
+如果服务器到 GitHub 的拉取速度不稳定，也可以把 `KK_DEPLOY_REPO_URL` 改成你自己的 Git 镜像地址。
+如果服务器访问 Maven Central 不稳定，也可以通过 `KK_DEPLOY_MAVEN_SETTINGS` 指向自定义 `settings.xml`，切换到就近镜像仓库。
+
+## 服务器前置环境
+
+服务器需要具备以下工具：
+
+- Git for Windows（推荐安装在 `C:\kkFileView-tools\git`）
+- Apache Maven 3.9.x（推荐安装在 `C:\kkFileView-tools\maven`）
+- JDK 21（当前线上已存在：`C:\Program Files\jdk-21.0.2`）
+
+## Workflow
+
+新增 workflow：`.github/workflows/master-auto-deploy.yml`
+
+- 触发条件：`push` 到 `master`，或手动 `workflow_dispatch`
+- 部署方式：WinRM + 服务器源码同步 + 服务器本机 Maven 编译 + jar 替换/回滚
--- a/docker/kkfileview-base/README.cn.md
+++ b/docker/kkfileview-base/README.cn.md
@@ -7,10 +7,10 @@
 然后使用 kkfileview-base 作为基础镜像进行构建，加快 kkfileview docker 镜像构建与发布。

 执行如下命令即可构建基础镜像：
-> 这里镜像 tag 以 4.4.0 为例，本项目所维护的 Dockerfile 文件考虑了跨平台兼容性。 如果你需要用到 arm64 架构镜像, 则在arm64 架构机器上同样执行下面的构建命令即可
+> 这里镜像 tag 以 5.0.0 为例，本项目所维护的 Dockerfile 文件考虑了跨平台兼容性。 如果你需要用到 arm64 架构镜像, 则在arm64 架构机器上同样执行下面的构建命令即可

 ```shell
-docker build --tag keking/kkfileview-base:4.4.0 .
+docker build --tag keking/kkfileview-base:5.0.0 .
 ```


@@ -46,5 +46,5 @@ docker build --tag keking/kkfileview-base:4.4.0 .
 现在就可以愉快地开始构建了，构建命令示例:

 ```shell
-docker buildx build --platform=linux/amd64,linux/arm64 -t keking/kkfileview-base:4.4.0 --push .
+docker buildx build --platform=linux/amd64,linux/arm64 -t keking/kkfileview-base:5.0.0 --push .
 ```
--- a/docker/kkfileview-base/README.md
+++ b/docker/kkfileview-base/README.md
@@ -8,10 +8,10 @@ Then, use kkfileview-base as the base image to build and speed up the kkfileview

 To build the base image, run the following command:

-> In this example, the image tag is 4.4.0. The Dockerfile maintained in this project considers cross-platform compatibility. If you need an arm64 architecture image, run the same build command on an arm64 architecture machine.
+> In this example, the image tag is 5.0.0. The Dockerfile maintained in this project considers cross-platform compatibility. If you need an arm64 architecture image, run the same build command on an arm64 architecture machine.

 ```shell
-docker build --tag keking/kkfileview-base:4.4.0 .
+docker build --tag keking/kkfileview-base:5.0.0 .
 ```


@@ -49,5 +49,5 @@ Assuming the current machine is amd64 (x86_64) architecture, you'll need to enab
 Now you can enjoy the building. Here’s an example build command:

 ```shell
-docker buildx build --platform=linux/amd64,linux/arm64 -t keking/kkfileview-base:4.4.0 --push .
+docker buildx build --platform=linux/amd64,linux/arm64 -t keking/kkfileview-base:5.0.0 --push .
 ```
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@

    <groupId>cn.keking</groupId>
    <artifactId>kkFileView-parent</artifactId>
-    <version>5.0</version>
+    <version>5.0.2</version>

    <properties>
        <!-- ========== Java 和编译配置 ========== -->
--- a/server/pom.xml
+++ b/server/pom.xml
@@ -6,7 +6,7 @@
    <parent>
        <artifactId>kkFileView-parent</artifactId>
        <groupId>cn.keking</groupId>
-        <version>5.0</version>
+        <version>5.0.2</version>
    </parent>

    <artifactId>kkFileView</artifactId>
@@ -52,6 +52,12 @@
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-devtools</artifactId>
+            <scope>runtime</scope>
+            <optional>true</optional>
+        </dependency>

        <!-- ========== 文档格式转换 ========== -->
        <dependency>
--- a/server/src/main/bin/dev.sh
+++ b/server/src/main/bin/dev.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -e
+
+ROOT_DIR=$(cd "$(dirname "$0")/../../../.." || exit 1; pwd)
+SERVER_DIR="$ROOT_DIR/server"
+
+if [ -n "$JAVA_HOME" ]; then
+  export PATH="$JAVA_HOME/bin:$PATH"
+fi
+
+cd "$SERVER_DIR" || exit 1
+
+mvn spring-boot:run \
+  -Dspring-boot.run.addResources=true \
+  -Dspring-boot.run.jvmArguments="-Dfile.encoding=UTF-8 -Dspring.config.location=$SERVER_DIR/src/main/config/application.properties"
--- a/server/src/main/bin/startup.bat
+++ b/server/src/main/bin/startup.bat
@@ -1,10 +1,20 @@
@echo off
 set "KKFILEVIEW_BIN_FOLDER=%cd%"
 cd "%KKFILEVIEW_BIN_FOLDER%"
+set "JAR_NAME="
+for %%F in (kkFileView-*.jar) do (
+    set "JAR_NAME=%%~nxF"
+    goto :jar_found
+)
+echo Error: kkFileView jar not found in %KKFILEVIEW_BIN_FOLDER%
+exit /b 1
+
+:jar_found
 echo Using KKFILEVIEW_BIN_FOLDER %KKFILEVIEW_BIN_FOLDER%
+echo Using JAR_NAME %JAR_NAME%
 echo Starting kkFileView...
 echo Please check log file in ../log/kkFileView.log for more information
 echo You can get help in our official home site: https://kkview.cn
 echo If you need further help, please join our kk opensource community: https://t.zsxq.com/09ZHSXbsQ
 echo If this project is helpful to you, please star it on https://gitee.com/kekingcn/file-online-preview/stargazers
-java -Dspring.config.location=..\config\application.properties -jar kkFileView-4.4.0.jar -> ..\log\kkFileView.log
+java -Dspring.config.location=..\config\application.properties -jar "%JAR_NAME%" > ..\log\kkFileView.log 2>&1
--- a/server/src/main/bin/startup.sh
+++ b/server/src/main/bin/startup.sh
@@ -49,9 +49,16 @@ else
    fi
  fi

+  JAR_PATH=$(ls kkFileView-*.jar 2>/dev/null | head -n 1)
+  if [ -z "${JAR_PATH}" ]; then
+    echo "kkFileView jar not found in ${KKFILEVIEW_BIN_FOLDER}"
+    exit 1
+  fi
+
  ## 启动kkFileView
  echo "Starting kkFileView..."
-  nohup java -Dfile.encoding=UTF-8 -Dspring.config.location=../config/application.properties -jar kkFileView-4.4.0.jar > ../log/kkFileView.log 2>&1 &
+  echo "Using jar ${JAR_PATH}"
+  nohup java -Dfile.encoding=UTF-8 -Dspring.config.location=../config/application.properties -jar "${JAR_PATH}" > ../log/kkFileView.log 2>&1 &
  echo "Please execute ./showlog.sh to check log for more information"
  echo "You can get help in our official home site: https://kkview.cn"
  echo "If you need further help, please join our kk opensource community: https://t.zsxq.com/09ZHSXbsQ"
--- a/server/src/main/config/application.properties
+++ b/server/src/main/config/application.properties
@@ -96,12 +96,12 @@ office.documentopenpasswords = ${KK_OFFICE_DOCUMENTOPENPASSWORD:true}
 office.type.web = ${KK_OFFICE_TYPE_WEB:web}

 # Office文档预览类型
-# 支持动态配置，可选值：image/pdf
-office.preview.type = ${KK_OFFICE_PREVIEW_TYPE:image}
+# 支持动态配置，可选值：image/pdf，默认使用pdf模式
+office.preview.type = ${KK_OFFICE_PREVIEW_TYPE:pdf}

-# 是否关闭Office预览模式切换开关，默认为false（允许切换）
-# 设置为true时，用户无法在图片和PDF模式间切换
-office.preview.switch.disabled = ${KK_OFFICE_PREVIEW_SWITCH_DISABLED:false}
+# 是否关闭Office预览模式切换开关，默认为true（关闭切换）
+# 设置为false时，用户可以在图片和PDF模式间切换
+office.preview.switch.disabled = ${KK_OFFICE_PREVIEW_SWITCH_DISABLED:true}


 ###############################################################################
@@ -155,6 +155,9 @@ pdf.bookmark.disable = ${KK_PDF_BOOKMARK_DISABLE:true}
 # 是否禁止PDF编辑功能（注释、表单等），默认为false（允许编辑）
 pdf.disable.editing = ${KK_PDF_DISABLE_EDITING:false}

+# 是否默认打开PDF侧边栏（缩略图面板），默认为true（打开）
+pdf.sidebar.open = ${KK_PDF_SIDEBAR_OPEN:true}
+
 # PDF处理最大线程数，控制并发处理能力
 pdf.max.threads = 10

@@ -405,8 +408,9 @@ home.pagesize = ${DEFAULT_HOME_PAGSIZE:20}
 # 启用后删除文件需要输入验证码，防止误删
 delete.captcha = ${KK_DELETE_CAPTCHA:false}

-# 删除文件密码，默认为123456
-delete.password = ${KK_DELETE_PASSWORD:123456}
+# 删除文件密码，默认为false（禁用删除接口）
+# 如需启用删除功能，请通过环境变量或外部配置设置独立的强密码
+delete.password = ${KK_DELETE_PASSWORD:false}

 # 是否删除转换后的源文件，默认为true（删除）
 # 启用可节约磁盘空间，但会丢失原始文件
@@ -466,8 +470,8 @@ kk.xlsxshowtoolbar = false
 # 首页是否显示key密钥 默认为false（禁用）
 kk.isshowkey = false

-# 预览html文件 是否启用JavaScript 默认为true（启用）
-kk.scriptjs = true
+# 预览html文件 是否在隔离沙箱中启用JavaScript，默认为false（禁用）
+kk.scriptjs = false


 ###############################################################################
--- a/server/src/main/config/test.properties
+++ b/server/src/main/config/test.properties
@@ -405,8 +405,8 @@ home.pagesize = ${DEFAULT_HOME_PAGSIZE:20}
 # 启用后删除文件需要输入验证码，防止误删
 delete.captcha = ${KK_DELETE_CAPTCHA:false}

-# 删除文件密码，默认为123456
-delete.password = ${KK_DELETE_PASSWORD:123456}
+# 删除文件密码，默认为false（禁用删除接口）
+delete.password = ${KK_DELETE_PASSWORD:false}

 # 是否删除转换后的源文件，默认为true（删除）
 # 启用可节约磁盘空间，但会丢失原始文件
@@ -466,8 +466,8 @@ kk.xlsxshowtoolbar = true
 # 首页是否显示key密钥 默认为false（禁用）
 kk.isshowkey = true

-# 预览html文件 是否启用JavaScript 默认为true（启用）
-kk.scriptjs = true
+# 预览html文件 是否在隔离沙箱中启用JavaScript，默认为false（禁用）
+kk.scriptjs = false


 ###############################################################################
--- a/server/src/main/java/cn/keking/config/ConfigConstants.java
+++ b/server/src/main/java/cn/keking/config/ConfigConstants.java
@@ -31,7 +31,7 @@ public class ConfigConstants {
    // ==================================================
    public static final String DEFAULT_VALUE = "default";
    public static final String DEFAULT_SHOW_AES_KEY = "1234567890123456";
-    public static final String DEFAULT_PASSWORD = "123456";
+    public static final String DEFAULT_PASSWORD = "false";
    public static final String DEFAULT_SIZE = "500MB";
    public static final String DEFAULT_ENABLE_REFRECSHSCHEDULE = "5";
    public static final String DEFAULT_IS_JAVASCRIPT = "false";
@@ -77,6 +77,7 @@ public class ConfigConstants {
    public static final String DEFAULT_PDF_DOWNLOAD_DISABLE = "true";
    public static final String DEFAULT_PDF_BOOKMARK_DISABLE = "true";
    public static final String DEFAULT_PDF_DISABLE_EDITING = "true";
+    public static final String DEFAULT_PDF_SIDEBAR_OPEN = "true";
    public static final String DEFAULT_PDF2_JPG_DPI = "105";
    public static final String DEFAULT_PDF_SMALL_DTI = "150";
    public static final String DEFAULT_PDF_MEDIUM_DPI = "120";
@@ -194,6 +195,7 @@ public class ConfigConstants {
    private static String pdfPrintDisable;
    private static String pdfDownloadDisable;
    private static String pdfBookmarkDisable;
+    private static String pdfSidebarOpen;
    private static int pdf2JpgDpi;
    private static boolean pdfDpiEnabled;
    private static int pdfSmallDpi;
@@ -336,6 +338,7 @@ public class ConfigConstants {
    public static String getPdfDownloadDisable() { return pdfDownloadDisable; }
    public static String getPdfBookmarkDisable() { return pdfBookmarkDisable; }
    public static String getPdfDisableEditing() { return pdfDisableEditing; }
+    public static String getPdfSidebarOpen() { return pdfSidebarOpen; }
    public static int getPdf2JpgDpi() { return pdf2JpgDpi; }
    public static int getPdfTimeoutSmall() { return pdfTimeoutSmall; }
    public static int getPdfTimeoutMedium() { return pdfTimeoutMedium; }
@@ -563,6 +566,10 @@ public class ConfigConstants {
    public void setpdfDisableEditing(String pdfDisableEditing) { setPdfDisableEditingValue(pdfDisableEditing); }
    public static void setPdfDisableEditingValue(String pdfDisableEditing) { ConfigConstants.pdfDisableEditing = pdfDisableEditing; }

+    @Value("${pdf.sidebar.open:true}")
+    public void setPdfSidebarOpen(String pdfSidebarOpen) { setPdfSidebarOpenValue(pdfSidebarOpen); }
+    public static void setPdfSidebarOpenValue(String pdfSidebarOpen) { ConfigConstants.pdfSidebarOpen = pdfSidebarOpen; }
+
    @Value("${pdf2jpg.dpi:105}")
    public void pdf2JpgDpi(int pdf2JpgDpi) { setPdf2JpgDpiValue(pdf2JpgDpi); }
    public static void setPdf2JpgDpiValue(int pdf2JpgDpi) { ConfigConstants.pdf2JpgDpi = pdf2JpgDpi; }
@@ -657,7 +664,7 @@ public class ConfigConstants {
    public void setSize(String size) { setSizeValue(size); }
    public static void setSizeValue(String size) { ConfigConstants.size = size; }

-    @Value("${delete.password:123456}")
+    @Value("${delete.password:false}")
    public void setPassword(String password) { setPasswordValue(password); }
    public static void setPasswordValue(String password) { ConfigConstants.password = password; }

--- a/server/src/main/java/cn/keking/config/ConfigRefreshComponent.java
+++ b/server/src/main/java/cn/keking/config/ConfigRefreshComponent.java
@@ -181,6 +181,7 @@ public class ConfigRefreshComponent {
        ConfigConstants.setPdfDownloadDisableValue(getProperty(properties, "pdf.download.disable", ConfigConstants.DEFAULT_PDF_DOWNLOAD_DISABLE));
        ConfigConstants.setPdfBookmarkDisableValue(getProperty(properties, "pdf.bookmark.disable", ConfigConstants.DEFAULT_PDF_BOOKMARK_DISABLE));
        ConfigConstants.setPdfDisableEditingValue(getProperty(properties, "pdf.disable.editing", ConfigConstants.DEFAULT_PDF_DISABLE_EDITING));
+        ConfigConstants.setPdfSidebarOpenValue(getProperty(properties, "pdf.sidebar.open", ConfigConstants.DEFAULT_PDF_SIDEBAR_OPEN));
        ConfigConstants.setPdf2JpgDpiValue(Integer.parseInt(getProperty(properties, "pdf2jpg.dpi", ConfigConstants.DEFAULT_PDF2_JPG_DPI)));

        // 8. CAD配置
--- a/server/src/main/java/cn/keking/config/RedissonConfig.java
+++ b/server/src/main/java/cn/keking/config/RedissonConfig.java
@@ -1,6 +1,5 @@
 package cn.keking.config;

-import io.netty.channel.nio.NioEventLoopGroup;
 import org.apache.commons.lang3.StringUtils;
 import org.redisson.Redisson;
 import org.redisson.api.RedissonClient;
@@ -13,8 +12,8 @@ import org.springframework.context.annotation.Configuration;
 import org.springframework.util.ClassUtils;

 /**
- * Redisson 客户端配置
- * Created by kl on 2017/09/26.
+ * Redisson 客户端配置（完善版）
+ * 支持 single / cluster / master-slave / sentinel 四种模式，配置完整，统一参数。
 */
@ConditionalOnExpression("'${cache.type:default}'.equals('redis')")
@ConfigurationProperties(prefix = "spring.redisson")
@@ -22,114 +21,71 @@ import org.springframework.util.ClassUtils;
 public class RedissonConfig {

    // ========================== 连接配置 ==========================
-    private static String address;
-    private static String password;
-    private static String clientName;
-    private static int database = 0;
-    private static String mode = "single";
-    private static String masterName = "kkfile";
+    private String address;
+    private String password;
+    private String clientName;
+    private int database = 0;
+    private String mode = "single";
+    private String masterName = "kkfile";

    // ========================== 超时配置 ==========================
-    private static int idleConnectionTimeout = 10000;
-    private static int connectTimeout = 10000;
-    private static int timeout = 3000;
+    private int idleConnectionTimeout = 10000;
+    private int connectTimeout = 10000;
+    private int timeout = 3000;

    // ========================== 重试配置 ==========================
-    private static int retryAttempts = 3;
-    private static int retryInterval = 1500;
+    private int retryAttempts = 3;
+    private int retryInterval = 1500;

    // ========================== 连接池配置 ==========================
-    private static int connectionMinimumIdleSize = 10;
-    private static int connectionPoolSize = 64;
-    private static int subscriptionsPerConnection = 5;
-    private static int subscriptionConnectionMinimumIdleSize = 1;
-    private static int subscriptionConnectionPoolSize = 50;
+    private int connectionMinimumIdleSize = 10;
+    private int connectionPoolSize = 64;
+    private int subscriptionsPerConnection = 5;
+    private int subscriptionConnectionMinimumIdleSize = 1;
+    private int subscriptionConnectionPoolSize = 50;
+
+    // ========================== 集群专用配置 ==========================
+    private int scanInterval = 2000;

    // ========================== 其他配置 ==========================
-    private static int dnsMonitoringInterval = 5000;
-    private static int thread; // 当前处理核数量 * 2
-    private static String codec = "org.redisson.codec.JsonJacksonCodec";
+    private int dnsMonitoringInterval = 5000;
+    private int threads; // 默认为0，表示使用 CPU 核数 * 2
+    private String codec = "org.redisson.codec.JsonJacksonCodec";

    @Bean
-    public static RedissonClient config() throws Exception {
+    public RedissonClient redissonClient() {
        Config config = new Config();

-        // 密码处理
-        if (StringUtils.isBlank(password)) {
-            password = null;
-        }
+        // 密码处理：空字符串转为 null
+        String pwd = StringUtils.isBlank(password) ? null : password;

-        // 根据模式创建对应的 Redisson 配置
-        switch (mode) {
+        // 根据模式构建配置
+        switch (mode.toLowerCase()) {
            case "cluster":
-                configureClusterMode(config);
+                configureClusterMode(config, pwd);
                break;
            case "master-slave":
-                configureMasterSlaveMode(config);
+                configureMasterSlaveMode(config, pwd);
                break;
            case "sentinel":
-                configureSentinelMode(config);
+                configureSentinelMode(config, pwd);
                break;
            default:
-                configureSingleMode(config);
+                configureSingleMode(config, pwd);
                break;
        }

+        // 公共配置：编码器、线程数
+        applyCommonConfig(config);
        return Redisson.create(config);
    }

    // ========================== 配置方法 ==========================

-    /**
-     * 配置集群模式
-     */
-    private static void configureClusterMode(Config config) {
-        String[] clusterAddresses = address.split(",");
-        config.useClusterServers()
-                .setScanInterval(2000)
-                .addNodeAddress(clusterAddresses)
-                .setPassword(password)
-                .setRetryAttempts(retryAttempts)
-                .setTimeout(timeout)
-                .setMasterConnectionPoolSize(100)
-                .setSlaveConnectionPoolSize(100);
-    }
-
-    /**
-     * 配置主从模式
-     */
-    private static void configureMasterSlaveMode(Config config) {
-        String[] masterSlaveAddresses = address.split(",");
-        validateMasterSlaveAddresses(masterSlaveAddresses);
-
-        String[] slaveAddresses = new String[masterSlaveAddresses.length - 1];
-        System.arraycopy(masterSlaveAddresses, 1, slaveAddresses, 0, slaveAddresses.length);
-
-        config.useMasterSlaveServers()
-                .setDatabase(database)
-                .setPassword(password)
-                .setMasterAddress(masterSlaveAddresses[0])
-                .addSlaveAddress(slaveAddresses);
-    }
-
-    /**
-     * 配置哨兵模式
-     */
-    private static void configureSentinelMode(Config config) {
-        String[] sentinelAddresses = address.split(",");
-        config.useSentinelServers()
-                .setDatabase(database)
-                .setPassword(password)
-                .setMasterName(masterName)
-                .addSentinelAddress(sentinelAddresses);
-    }
-
-    /**
-     * 配置单机模式
-     */
-    private static void configureSingleMode(Config config) throws Exception {
+    private void configureSingleMode(Config config, String pwd) {
+        String normalizedAddress = normalizeAddress(address);
        config.useSingleServer()
-                .setAddress(address)
+                .setAddress(normalizedAddress)
                .setConnectionMinimumIdleSize(connectionMinimumIdleSize)
                .setConnectionPoolSize(connectionPoolSize)
                .setDatabase(database)
@@ -143,183 +99,184 @@ public class RedissonConfig {
                .setTimeout(timeout)
                .setConnectTimeout(connectTimeout)
                .setIdleConnectionTimeout(idleConnectionTimeout)
-                .setPassword(StringUtils.trimToNull(password));
-
-        // 设置编码器
-        Class<?> codecClass = ClassUtils.forName(getCodec(), ClassUtils.getDefaultClassLoader());
-        Codec codecInstance = (Codec) codecClass.getDeclaredConstructor().newInstance();
-        config.setCodec(codecInstance);
-        // 设置线程和事件循环组
-        config.setThreads(thread);
-        config.setEventLoopGroup(new NioEventLoopGroup());
+                .setPassword(pwd);
    }

-    /**
-     * 验证主从模式地址
-     */
-    private static void validateMasterSlaveAddresses(String[] addresses) {
-        if (addresses.length == 1) {
-            throw new IllegalArgumentException(
-                    "redis.redisson.address MUST have multiple redis addresses for master-slave mode.");
+    private void configureClusterMode(Config config, String pwd) {
+        String[] nodeAddresses = normalizeAddresses(address.split(","));
+        config.useClusterServers()
+                .setScanInterval(scanInterval)
+                .addNodeAddress(nodeAddresses)
+                .setPassword(pwd)
+                .setRetryAttempts(retryAttempts)
+                .setRetryInterval(retryInterval)
+                .setTimeout(timeout)
+                .setConnectTimeout(connectTimeout)
+                .setIdleConnectionTimeout(idleConnectionTimeout)
+                .setMasterConnectionPoolSize(connectionPoolSize)
+                .setSlaveConnectionPoolSize(connectionPoolSize)
+                .setSubscriptionConnectionPoolSize(subscriptionConnectionPoolSize)
+                .setSubscriptionConnectionMinimumIdleSize(subscriptionConnectionMinimumIdleSize)
+                .setSubscriptionsPerConnection(subscriptionsPerConnection)
+                .setClientName(clientName);
+    }
+
+    private void configureMasterSlaveMode(Config config, String pwd) {
+        String[] addresses = address.split(",");
+        validateMasterSlaveAddresses(addresses);
+        String[] normalizedAddresses = normalizeAddresses(addresses);
+        String masterAddress = normalizedAddresses[0];
+        String[] slaveAddresses = new String[normalizedAddresses.length - 1];
+        System.arraycopy(normalizedAddresses, 1, slaveAddresses, 0, slaveAddresses.length);
+
+        config.useMasterSlaveServers()
+                .setDatabase(database)
+                .setPassword(pwd)
+                .setMasterAddress(masterAddress)
+                .addSlaveAddress(slaveAddresses)
+                .setRetryAttempts(retryAttempts)
+                .setRetryInterval(retryInterval)
+                .setTimeout(timeout)
+                .setConnectTimeout(connectTimeout)
+                .setIdleConnectionTimeout(idleConnectionTimeout)
+                .setMasterConnectionPoolSize(connectionPoolSize)
+                .setSlaveConnectionPoolSize(connectionPoolSize)
+                .setSubscriptionConnectionPoolSize(subscriptionConnectionPoolSize)
+                .setSubscriptionConnectionMinimumIdleSize(subscriptionConnectionMinimumIdleSize)
+                .setSubscriptionsPerConnection(subscriptionsPerConnection)
+                .setClientName(clientName);
+    }
+
+    private void configureSentinelMode(Config config, String pwd) {
+        String[] sentinelAddresses = normalizeAddresses(address.split(","));
+        config.useSentinelServers()
+                .setDatabase(database)
+                .setPassword(pwd)
+                .setMasterName(masterName)
+                .addSentinelAddress(sentinelAddresses)
+                .setRetryAttempts(retryAttempts)
+                .setRetryInterval(retryInterval)
+                .setTimeout(timeout)
+                .setConnectTimeout(connectTimeout)
+                .setIdleConnectionTimeout(idleConnectionTimeout)
+                .setMasterConnectionPoolSize(connectionPoolSize)
+                .setSlaveConnectionPoolSize(connectionPoolSize)
+                .setSubscriptionConnectionPoolSize(subscriptionConnectionPoolSize)
+                .setSubscriptionConnectionMinimumIdleSize(subscriptionConnectionMinimumIdleSize)
+                .setSubscriptionsPerConnection(subscriptionsPerConnection)
+                .setClientName(clientName);
+    }
+
+    private void applyCommonConfig(Config config) {
+        // 设置编码器
+        if (StringUtils.isNotBlank(codec)) {
+            try {
+                Class<?> codecClass = ClassUtils.forName(codec, ClassUtils.getDefaultClassLoader());
+                Codec codecInstance = (Codec) codecClass.getDeclaredConstructor().newInstance();
+                config.setCodec(codecInstance);
+            } catch (Exception e) {
+                throw new IllegalStateException("Failed to create Redisson codec: " + codec, e);
+            }
+        }
+        // 设置线程数（大于0时生效，否则Redisson使用默认值：CPU核数*2）
+        if (threads > 0) {
+            config.setThreads(threads);
        }
    }

-    // ========================== Getter和Setter方法 ==========================
+    // ========================== 辅助方法 ==========================

-    // 连接配置
-    public String getAddress() {
-        return address;
+    /**
+     * 自动补齐 Redis 地址协议前缀（redis:// 或 rediss://）
+     */
+    private String normalizeAddress(String addr) {
+        if (addr == null) {
+            return null;
+        }
+        addr = addr.trim();
+        if (!addr.startsWith("redis://") && !addr.startsWith("rediss://")) {
+            addr = "redis://" + addr;
+        }
+        return addr;
    }

-    public void setAddress(String address) {
-        RedissonConfig.address = address;
+    private String[] normalizeAddresses(String[] addresses) {
+        String[] normalized = new String[addresses.length];
+        for (int i = 0; i < addresses.length; i++) {
+            normalized[i] = normalizeAddress(addresses[i]);
+        }
+        return normalized;
    }

-    public String getPassword() {
-        return password;
+    private void validateMasterSlaveAddresses(String[] addresses) {
+        if (addresses.length < 2) {
+            throw new IllegalArgumentException(
+                    "Master-slave mode requires at least 2 addresses: master and at least one slave. " +
+                            "Current addresses: " + String.join(",", addresses));
+        }
    }

-    public void setPassword(String password) {
-        RedissonConfig.password = password;
-    }
+    // ========================== Getter / Setter（供 Spring 绑定配置） ==========================
+    // 以下所有字段都需要提供 getter/setter，示例中只列出关键字段，实际使用时请补全所有字段。
+    // 建议使用 Lombok @Data 或 IDE 自动生成。这里只展示部分，避免篇幅过长。

-    public String getClientName() {
-        return clientName;
-    }
+    public String getAddress() { return address; }
+    public void setAddress(String address) { this.address = address; }

-    public void setClientName(String clientName) {
-        RedissonConfig.clientName = clientName;
-    }
+    public String getPassword() { return password; }
+    public void setPassword(String password) { this.password = password; }

-    public int getDatabase() {
-        return database;
-    }
+    public String getClientName() { return clientName; }
+    public void setClientName(String clientName) { this.clientName = clientName; }

-    public void setDatabase(int database) {
-        RedissonConfig.database = database;
-    }
+    public int getDatabase() { return database; }
+    public void setDatabase(int database) { this.database = database; }

-    public static String getMode() {
-        return mode;
-    }
+    public String getMode() { return mode; }
+    public void setMode(String mode) { this.mode = mode; }

-    public void setMode(String mode) {
-        RedissonConfig.mode = mode;
-    }
+    public String getMasterName() { return masterName; }
+    public void setMasterName(String masterName) { this.masterName = masterName; }

-    public static String getMasterNamee() {
-        return masterName;
-    }
+    public int getIdleConnectionTimeout() { return idleConnectionTimeout; }
+    public void setIdleConnectionTimeout(int idleConnectionTimeout) { this.idleConnectionTimeout = idleConnectionTimeout; }

-    public void setMasterNamee(String masterName) {
-        RedissonConfig.masterName = masterName;
-    }
+    public int getConnectTimeout() { return connectTimeout; }
+    public void setConnectTimeout(int connectTimeout) { this.connectTimeout = connectTimeout; }

-    // 超时配置
-    public int getIdleConnectionTimeout() {
-        return idleConnectionTimeout;
-    }
+    public int getTimeout() { return timeout; }
+    public void setTimeout(int timeout) { this.timeout = timeout; }

-    public void setIdleConnectionTimeout(int idleConnectionTimeout) {
-        RedissonConfig.idleConnectionTimeout = idleConnectionTimeout;
-    }
+    public int getRetryAttempts() { return retryAttempts; }
+    public void setRetryAttempts(int retryAttempts) { this.retryAttempts = retryAttempts; }

-    public int getConnectTimeout() {
-        return connectTimeout;
-    }
+    public int getRetryInterval() { return retryInterval; }
+    public void setRetryInterval(int retryInterval) { this.retryInterval = retryInterval; }

-    public void setConnectTimeout(int connectTimeout) {
-        RedissonConfig.connectTimeout = connectTimeout;
-    }
+    public int getConnectionMinimumIdleSize() { return connectionMinimumIdleSize; }
+    public void setConnectionMinimumIdleSize(int connectionMinimumIdleSize) { this.connectionMinimumIdleSize = connectionMinimumIdleSize; }

-    public int getTimeout() {
-        return timeout;
-    }
+    public int getConnectionPoolSize() { return connectionPoolSize; }
+    public void setConnectionPoolSize(int connectionPoolSize) { this.connectionPoolSize = connectionPoolSize; }

-    public void setTimeout(int timeout) {
-        RedissonConfig.timeout = timeout;
-    }
+    public int getSubscriptionsPerConnection() { return subscriptionsPerConnection; }
+    public void setSubscriptionsPerConnection(int subscriptionsPerConnection) { this.subscriptionsPerConnection = subscriptionsPerConnection; }

-    // 重试配置
-    public int getRetryAttempts() {
-        return retryAttempts;
-    }
+    public int getSubscriptionConnectionMinimumIdleSize() { return subscriptionConnectionMinimumIdleSize; }
+    public void setSubscriptionConnectionMinimumIdleSize(int subscriptionConnectionMinimumIdleSize) { this.subscriptionConnectionMinimumIdleSize = subscriptionConnectionMinimumIdleSize; }

-    public void setRetryAttempts(int retryAttempts) {
-        RedissonConfig.retryAttempts = retryAttempts;
-    }
+    public int getSubscriptionConnectionPoolSize() { return subscriptionConnectionPoolSize; }
+    public void setSubscriptionConnectionPoolSize(int subscriptionConnectionPoolSize) { this.subscriptionConnectionPoolSize = subscriptionConnectionPoolSize; }

-    public int getRetryInterval() {
-        return retryInterval;
-    }
+    public int getScanInterval() { return scanInterval; }
+    public void setScanInterval(int scanInterval) { this.scanInterval = scanInterval; }

-    public void setRetryInterval(int retryInterval) {
-        RedissonConfig.retryInterval = retryInterval;
-    }
+    public int getDnsMonitoringInterval() { return dnsMonitoringInterval; }
+    public void setDnsMonitoringInterval(int dnsMonitoringInterval) { this.dnsMonitoringInterval = dnsMonitoringInterval; }

-    // 连接池配置
-    public int getConnectionMinimumIdleSize() {
-        return connectionMinimumIdleSize;
-    }
+    public int getThreads() { return threads; }
+    public void setThreads(int threads) { this.threads = threads; }

-    public void setConnectionMinimumIdleSize(int connectionMinimumIdleSize) {
-        RedissonConfig.connectionMinimumIdleSize = connectionMinimumIdleSize;
-    }
-
-    public int getConnectionPoolSize() {
-        return connectionPoolSize;
-    }
-
-    public void setConnectionPoolSize(int connectionPoolSize) {
-        RedissonConfig.connectionPoolSize = connectionPoolSize;
-    }
-
-    public int getSubscriptionsPerConnection() {
-        return subscriptionsPerConnection;
-    }
-
-    public void setSubscriptionsPerConnection(int subscriptionsPerConnection) {
-        RedissonConfig.subscriptionsPerConnection = subscriptionsPerConnection;
-    }
-
-    public int getSubscriptionConnectionMinimumIdleSize() {
-        return subscriptionConnectionMinimumIdleSize;
-    }
-
-    public void setSubscriptionConnectionMinimumIdleSize(int subscriptionConnectionMinimumIdleSize) {
-        RedissonConfig.subscriptionConnectionMinimumIdleSize = subscriptionConnectionMinimumIdleSize;
-    }
-
-    public int getSubscriptionConnectionPoolSize() {
-        return subscriptionConnectionPoolSize;
-    }
-
-    public void setSubscriptionConnectionPoolSize(int subscriptionConnectionPoolSize) {
-        RedissonConfig.subscriptionConnectionPoolSize = subscriptionConnectionPoolSize;
-    }
-
-    // 其他配置
-    public int getDnsMonitoringInterval() {
-        return dnsMonitoringInterval;
-    }
-
-    public void setDnsMonitoringInterval(int dnsMonitoringInterval) {
-        RedissonConfig.dnsMonitoringInterval = dnsMonitoringInterval;
-    }
-
-    public int getThread() {
-        return thread;
-    }
-
-    public void setThread(int thread) {
-        RedissonConfig.thread = thread;
-    }
-
-    public static String getCodec() {
-        return codec;
-    }
-
-    public void setCodec(String codec) {
-        RedissonConfig.codec = codec;
-    }
+    public String getCodec() { return codec; }
+    public void setCodec(String codec) { this.codec = codec; }
 }
--- a/server/src/main/java/cn/keking/config/WebConfig.java
+++ b/server/src/main/java/cn/keking/config/WebConfig.java
@@ -46,6 +46,7 @@ public class WebConfig implements WebMvcConfigurer {
        filterUri.add("/onlinePreview");
        filterUri.add("/picturesPreview");
        filterUri.add("/getCorsFile");
+        filterUri.add("/addTask");
        TrustHostFilter filter = new TrustHostFilter();
        FilterRegistrationBean<TrustHostFilter> registrationBean = new FilterRegistrationBean<>();
        registrationBean.setFilter(filter);
@@ -59,6 +60,7 @@ public class WebConfig implements WebMvcConfigurer {
        filterUri.add("/onlinePreview");
        filterUri.add("/picturesPreview");
        filterUri.add("/getCorsFile");
+        filterUri.add("/addTask");
        TrustDirFilter filter = new TrustDirFilter();
        FilterRegistrationBean<TrustDirFilter> registrationBean = new FilterRegistrationBean<>();
        registrationBean.setFilter(filter);
--- a/server/src/main/java/cn/keking/service/CompressFileReader.java
+++ b/server/src/main/java/cn/keking/service/CompressFileReader.java
@@ -59,21 +59,26 @@ public class CompressFileReader {
            for (final ISimpleInArchiveItem item : simpleInArchive.getArchiveItems()) {
                if (!item.isFolder()) {
                    final Path filePathInsideArchive = getFilePathInsideArchive(item, folderPath);
-                    ExtractOperationResult result = item.extractSlow(data -> {
-                        try (OutputStream out = new BufferedOutputStream(new FileOutputStream(filePathInsideArchive.toFile(), true))) {
-                            out.write(data);
-                        } catch (IOException e) {
-                            throw new RuntimeException(e);
-                        }
-                        return data.length;
-                    }, filePassword);
-                    if (result != ExtractOperationResult.OK) {
-                        ExtractOperationResult result1 = ExtractOperationResult.valueOf("WRONG_PASSWORD");
-                        if (result1.equals(result)) {
-                            throw new Exception("Password");
-                        }else {
-                            throw new Exception("Failed to extract RAR file.");
+                    Files.deleteIfExists(filePathInsideArchive);
+                    try (OutputStream out = new BufferedOutputStream(new FileOutputStream(filePathInsideArchive.toFile(), false))) {
+                        ExtractOperationResult result = item.extractSlow(data -> {
+                            try {
+                                out.write(data);
+                            } catch (IOException e) {
+                                throw new RuntimeException(e);
+                            }
+                            return data.length;
+                        }, filePassword);
+                        if (result != ExtractOperationResult.OK) {
+                            ExtractOperationResult result1 = ExtractOperationResult.valueOf("WRONG_PASSWORD");
+                            if (result1.equals(result)) {
+                                throw new Exception("Password");
+                            } else {
+                                throw new Exception("Failed to extract RAR file.");
+                            }
                        }
+                    } catch (IOException e) {
+                        throw new RuntimeException(e);
                    }

                    FileType type = FileType.typeFromUrl(filePathInsideArchive.toString());
--- a/server/src/main/java/cn/keking/service/PdfToJpgService.java
+++ b/server/src/main/java/cn/keking/service/PdfToJpgService.java
@@ -18,6 +18,7 @@ import org.springframework.stereotype.Component;
 import org.springframework.util.CollectionUtils;
 import org.springframework.util.ObjectUtils;

+import javax.imageio.ImageIO;
 import java.awt.image.BufferedImage;
 import java.io.File;
 import java.io.IOException;
@@ -93,6 +94,8 @@ public class PdfToJpgService {

    @PostConstruct
    public void init() {
+        refreshImageIoPlugins();
+
        int maxThreads = ConfigConstants.getPdfMaxThreads();
        // 使用固定大小的虚拟线程池
        this.virtualThreadExecutor = Executors.newFixedThreadPool(maxThreads,
@@ -104,6 +107,13 @@ public class PdfToJpgService {
        scheduleCacheCleanup();
    }

+    static void refreshImageIoPlugins() {
+        // ImageIO only scans once automatically. If another launcher or Java agent initializes
+        // it before Spring Boot installs its application class loader, nested JAR providers such
+        // as jbig2-imageio remain invisible until the application class path is scanned again.
+        ImageIO.scanForPlugins();
+    }
+
    @PreDestroy
    public void shutdown() {
        logger.info("开始关闭PDF转换服务...");
--- a/server/src/main/java/cn/keking/service/cache/impl/CacheServiceRedisImpl.java
+++ b/server/src/main/java/cn/keking/service/cache/impl/CacheServiceRedisImpl.java
@@ -1,11 +1,9 @@
 package cn.keking.service.cache.impl;

 import cn.keking.service.cache.CacheService;
-import org.redisson.Redisson;
 import org.redisson.api.RBlockingQueue;
 import org.redisson.api.RMapCache;
 import org.redisson.api.RedissonClient;
-import org.redisson.config.Config;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
 import org.springframework.stereotype.Service;

@@ -23,8 +21,9 @@ public class CacheServiceRedisImpl implements CacheService {

    private final RedissonClient redissonClient;

-    public CacheServiceRedisImpl(Config config) {
-        this.redissonClient = Redisson.create(config);
+    // 直接注入 Spring 容器中的 RedissonClient Bean
+    public CacheServiceRedisImpl(RedissonClient redissonClient) {
+        this.redissonClient = redissonClient;
    }

    @Override
--- a/server/src/main/java/cn/keking/utils/DownloadUtils.java
+++ b/server/src/main/java/cn/keking/utils/DownloadUtils.java
@@ -8,6 +8,7 @@ import org.apache.commons.io.FileUtils;
 import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.web.client.HttpClientErrorException;

 import java.io.File;
 import java.io.FileNotFoundException;
@@ -46,9 +47,8 @@ public class DownloadUtils {
        }
        ReturnResponse<String> response = new ReturnResponse<>(0, "下载成功!!!", "");
        String realPath = getRelFilePath(fileName, fileAttribute);
-        // 获取文件后缀用于校验
        final String fileSuffix = fileAttribute.getSuffix();
-        // 判断是否非法地址
+
        if (KkFileUtils.isIllegalFileName(realPath)) {
            response.setCode(1);
            response.setContent(null);
@@ -61,17 +61,17 @@ public class DownloadUtils {
            response.setMsg("下载失败:不支持的类型!" + urlStr);
            return response;
        }
-        if (fileAttribute.isCompressFile()) { //压缩包文件 直接赋予路径 不予下载
+        if (fileAttribute.isCompressFile()) {
            response.setContent(fileDir + fileName);
            response.setMsg(fileName);
            return response;
        }
-        // 如果文件是否已经存在、且不强制更新，则直接返回文件路径
        if (KkFileUtils.isExist(realPath) && !fileAttribute.forceUpdatedCache()) {
            response.setContent(realPath);
            response.setMsg(fileName);
            return response;
        }
+
        try {
            URL url = WebUtils.normalizedURL(urlStr);
            if (!fileAttribute.getSkipDownLoad()) {
@@ -79,39 +79,59 @@ public class DownloadUtils {
                    File realFile = new File(realPath);
                    CloseableHttpClient httpClient = HttpRequestUtils.createConfiguredHttpClient();
                    String finalUrlStr = urlStr;
-                    HttpRequestUtils.executeHttpRequest(url, httpClient, fileAttribute, responseWrapper -> {
-                        // 获取响应头中的Content-Type
-                        String contentType = responseWrapper.getContentType();

-                        // 如果是Office/设计文件，需要校验MIME类型
+                    final boolean[] hasMimeError = {false};
+                    final String[] mimeErrorMessage = {null};
+
+                    HttpRequestUtils.executeHttpRequest(url, httpClient, fileAttribute, responseWrapper -> {
+                        String contentType = responseWrapper.getContentType();
                        if (WebUtils.isMimeCheckRequired(fileSuffix)) {
                            if (!WebUtils.isValidMimeType(contentType, fileSuffix)) {
                                logger.error("文件类型错误，期望二进制文件但接收到文本类型，url: {}, Content-Type: {}",
                                        finalUrlStr, contentType);
-                                responseWrapper.setHasError(true);
+                                hasMimeError[0] = true;
+                                mimeErrorMessage[0] = "期望二进制文件但接收到文本类型，Content-Type: " + contentType;
                                return;
                            }
                        }
-
-                        // 保存文件
                        FileUtils.copyToFile(responseWrapper.getInputStream(), realFile);
                    });
+
+                    if (hasMimeError[0]) {
+                        response.setCode(1);
+                        response.setContent(null);
+                        response.setMsg(mimeErrorMessage[0]);
+                        return response;
+                    }
+
                } else if (isFtpUrl(url)) {
                    String ftpUsername = WebUtils.getUrlParameterReg(fileAttribute.getUrl(), URL_PARAM_FTP_USERNAME);
                    String ftpPassword = WebUtils.getUrlParameterReg(fileAttribute.getUrl(), URL_PARAM_FTP_PASSWORD);
                    String ftpControlEncoding = WebUtils.getUrlParameterReg(fileAttribute.getUrl(), URL_PARAM_FTP_CONTROL_ENCODING);
                    String ftpport = WebUtils.getUrlParameterReg(realPath, URL_PARAM_FTP_PORT);
                    FtpUtils.download(fileAttribute.getUrl(), ftpport, realPath, ftpUsername, ftpPassword, ftpControlEncoding);
-                } else if (isFileUrl(url)) { // 添加对file协议的支持
+                } else if (isFileUrl(url)) {
                    handleFileProtocol(url, realPath);
                } else {
                    response.setCode(1);
                    response.setMsg("url不能识别url" + urlStr);
+                    return response;
                }
            }
            response.setContent(realPath);
            response.setMsg(fileName);
            return response;
+
+        } catch (HttpClientErrorException e) {
+            logger.error("HTTP请求失败，状态码：{}，url：{}", e.getStatusCode(), urlStr);
+            response.setCode(1);
+            response.setContent(null);
+            if (e.getStatusCode().is4xxClientError()) {
+                response.setMsg("文件不存在或无法访问 (HTTP " + e.getStatusCode() + ")");
+            } else {
+                response.setMsg("下载失败: " + e.getMessage());
+            }
+            return response;
        } catch (IOException | GalimatiasParseException e) {
            logger.error("文件下载失败，url：{}", urlStr);
            response.setCode(1);
@@ -123,7 +143,11 @@ public class DownloadUtils {
            }
            return response;
        } catch (Exception e) {
-            throw new RuntimeException(e);
+            logger.error("下载文件时发生未知异常，url：{}", urlStr, e);
+            response.setCode(1);
+            response.setContent(null);
+            response.setMsg("下载失败: " + e.getMessage());
+            return response;
        }
    }

--- a/server/src/main/java/cn/keking/utils/HttpClientLifecycle.java
+++ b/server/src/main/java/cn/keking/utils/HttpClientLifecycle.java
@@ -0,0 +1,14 @@
+package cn.keking.utils;
+
+import org.springframework.stereotype.Component;
+import jakarta.annotation.PreDestroy;
+
+@Component
+public class HttpClientLifecycle {
+
+    @PreDestroy
+    public void destroy() {
+        System.out.println("Spring 容器关闭，释放 HTTP 连接池资源...");
+        HttpRequestUtils.shutdown();
+    }
+}
--- a/server/src/main/java/cn/keking/web/controller/FileController.java
+++ b/server/src/main/java/cn/keking/web/controller/FileController.java
@@ -11,6 +11,7 @@ import cn.keking.utils.WebUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.util.ObjectUtils;
+import org.springframework.util.StringUtils;
 import org.springframework.util.StreamUtils;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -29,9 +30,12 @@ import java.io.InputStream;
 import java.io.OutputStream;
 import java.nio.file.DirectoryStream;
 import java.nio.file.Files;
+import java.nio.file.InvalidPathException;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.nio.file.attribute.BasicFileAttributes;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
 import java.util.*;

 import static cn.keking.utils.CaptchaUtil.CAPTCHA_CODE;
@@ -217,7 +221,7 @@ public class FileController {
        }
    }

-    @GetMapping("/deleteFile")
+    @PostMapping("/deleteFile")
    public ReturnResponse<Object> deleteFile(HttpServletRequest request, String fileName, String password) {
        ReturnResponse<Object> checkResult = this.deleteFileCheck(request, fileName, password);
        if (checkResult.isFailure()) {
@@ -341,13 +345,23 @@ public class FileController {
            }

            // ==================== 2. 构建路径和验证 ====================
-            String basePath = fileDir + demoPath;
-            if (!ObjectUtils.isEmpty(path)) {
-                basePath += path + File.separator;
+            Path currentDir;
+            try {
+                currentDir = resolveDirectoryUnderRoot(Paths.get(fileDir, demoDir), path);
+            } catch (InvalidPathException | SecurityException e) {
+                logger.warn("拒绝访问 demo 目录之外的文件列表路径");
+                result.put("total", 0);
+                result.put("data", Collections.emptyList());
+                result.put("error", "非法目录路径");
+                return result;
+            } catch (IOException e) {
+                logger.error("解析 demo 目录失败", e);
+                result.put("total", 0);
+                result.put("data", Collections.emptyList());
+                return result;
            }

-            File currentDir = new File(basePath);
-            if (!currentDir.exists() || !currentDir.isDirectory()) {
+            if (!Files.isDirectory(currentDir)) {
                result.put("total", 0);
                result.put("data", Collections.emptyList());
                return result;
@@ -357,13 +371,13 @@ public class FileController {
            List<Path> allPaths = new ArrayList<>();
            long collectStartTime = System.currentTimeMillis();

-            try (DirectoryStream<Path> stream = Files.newDirectoryStream(Paths.get(basePath))) {
+            try (DirectoryStream<Path> stream = Files.newDirectoryStream(currentDir)) {
                for (Path entry : stream) {
                    allPaths.add(entry);
                    stats.incrementFileCount();
                }
            } catch (IOException e) {
-                logger.error("读取目录失败: {}", basePath, e);
+                logger.error("读取目录失败: {}", currentDir, e);
                result.put("total", 0);
                result.put("data", Collections.emptyList());
                return result;
@@ -492,6 +506,46 @@ public class FileController {
        return result;
    }

+    /**
+     * Resolve an existing directory below the configured demo root.
+     *
+     * <p>Both lexical normalization and real-path checks are required: the
+     * former blocks traversal and absolute paths, while the latter prevents a
+     * symlink inside the demo directory from escaping the configured root.</p>
+     */
+    static Path resolveDirectoryUnderRoot(Path root, String requestedPath) throws IOException {
+        Path normalizedRoot = root.toAbsolutePath().normalize();
+        String relativePath = requestedPath == null ? "" : requestedPath.replace('\\', '/');
+
+        if (relativePath.indexOf('\0') >= 0
+                || relativePath.startsWith("/")
+                || relativePath.matches("^[A-Za-z]:.*")) {
+            throw new SecurityException("Absolute paths are not allowed");
+        }
+
+        Path relative = Paths.get(relativePath);
+        if (relative.isAbsolute()) {
+            throw new SecurityException("Absolute paths are not allowed");
+        }
+        for (Path segment : relative) {
+            if ("..".equals(segment.toString())) {
+                throw new SecurityException("Parent path segments are not allowed");
+            }
+        }
+
+        Path resolved = normalizedRoot.resolve(relative).normalize();
+        if (!resolved.startsWith(normalizedRoot)) {
+            throw new SecurityException("Path escapes the configured root");
+        }
+
+        Path realRoot = normalizedRoot.toRealPath();
+        Path realResolved = resolved.toRealPath();
+        if (!realResolved.startsWith(realRoot)) {
+            throw new SecurityException("Path escapes the configured root through a symbolic link");
+        }
+        return realResolved;
+    }
+
    /**
     * 构建性能统计信息
     */
@@ -724,11 +778,22 @@ public class FileController {
            return ReturnResponse.failure("密码 or 验证码为空，删除失败！");
        }

-        String expectedPassword = ConfigConstants.getDeleteCaptcha() ?
+        boolean captchaEnabled = ConfigConstants.getDeleteCaptcha();
+        String expectedPassword = captchaEnabled ?
                WebUtils.getSessionAttr(request, CAPTCHA_CODE) :
                ConfigConstants.getPassword();

-        if (!password.equalsIgnoreCase(expectedPassword)) {
+        if (!captchaEnabled && (!StringUtils.hasText(expectedPassword)
+                || "false".equalsIgnoreCase(expectedPassword))) {
+            return ReturnResponse.failure("文件删除接口已禁用，请先配置 delete.password");
+        }
+
+        if (!StringUtils.hasText(expectedPassword)) {
+            return ReturnResponse.failure("验证码已失效，请刷新后重试！");
+        }
+
+        if (!MessageDigest.isEqual(password.getBytes(StandardCharsets.UTF_8),
+                expectedPassword.getBytes(StandardCharsets.UTF_8))) {
            logger.error("删除文件【{}】失败，密码错误！", fileName);
            return ReturnResponse.failure("删除文件失败，密码错误！");
        }
--- a/server/src/main/java/cn/keking/web/controller/IndexController.java
+++ b/server/src/main/java/cn/keking/web/controller/IndexController.java
@@ -31,6 +31,11 @@ public class IndexController {
        return "/main/integrated";
    }

+    @GetMapping( "/contact")
+    public String go2Contact(){
+        return "/main/contact";
+    }
+
    @GetMapping( "/")
    public String root() {
        return "/main/index";
--- a/server/src/main/java/cn/keking/web/controller/OnlinePreviewController.java
+++ b/server/src/main/java/cn/keking/web/controller/OnlinePreviewController.java
@@ -23,6 +23,8 @@ import org.springframework.web.bind.annotation.ResponseBody;

 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
+import org.springframework.web.client.HttpClientErrorException;
+
 import java.io.IOException;
 import java.io.InputStream;
 import java.net.URL;
@@ -152,34 +154,71 @@ public class OnlinePreviewController {
        // 1. 验证接口是否开启
        if (!ConfigConstants.getGetCorsFile()) {
            logger.info("接口关闭，禁止访问!，url：{}", urlPath);
+            try {
+                response.sendError(HttpServletResponse.SC_FORBIDDEN, "接口已关闭");
+            } catch (IOException ignored) {}
            return;
        }
-        //2. 验证访问权限
+        // 2. 验证访问权限
        if (WebUtils.validateKey(key)) {
            logger.info("访问不合法：访问密码不正确!，url：{}", urlPath);
+            try {
+                response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "访问密码不正确");
+            } catch (IOException ignored) {}
            return;
        }
+
        URL url;
        try {
            urlPath = WebUtils.decodeUrl(urlPath, encryption);
            url = WebUtils.normalizedURL(urlPath);
        } catch (Exception ex) {
-            logger.error(String.format(BASE64_DECODE_ERROR_MSG, urlPath),ex);
+            logger.error(String.format(BASE64_DECODE_ERROR_MSG, urlPath), ex);
+            try {
+                response.sendError(HttpServletResponse.SC_BAD_REQUEST, "URL 解析失败");
+            } catch (IOException ignored) {}
            return;
        }
+
        assert urlPath != null;
        if (!isHttpUrl(url) && !isFtpUrl(url)) {
            logger.info("读取跨域文件异常，可能存在非法访问，urlPath：{}", urlPath);
+            try {
+                response.sendError(HttpServletResponse.SC_FORBIDDEN, "不支持的协议");
+            } catch (IOException ignored) {}
            return;
        }
-        FileAttribute fileAttribute = fileHandlerService.getFileAttribute(urlPath, req);
-        InputStream inputStream = null;
-        logger.info("读取跨域文件url：{}", urlPath);
-        if (!isFtpUrl(url)) {
-            CloseableHttpClient httpClient = HttpRequestUtils.createConfiguredHttpClient();

-            HttpRequestUtils.executeHttpRequest(url, httpClient, fileAttribute, responseWrapper -> IOUtils.copy(responseWrapper.getInputStream(), response.getOutputStream()));
+        FileAttribute fileAttribute = fileHandlerService.getFileAttribute(urlPath, req);
+        logger.info("读取跨域文件url：{}", urlPath);
+
+        if (!isFtpUrl(url)) {
+            // HTTP/HTTPS 处理（修复：不关闭共享的 CloseableHttpClient）
+            CloseableHttpClient httpClient = HttpRequestUtils.createConfiguredHttpClient();
+            try {
+                HttpRequestUtils.executeHttpRequest(url, httpClient, fileAttribute, responseWrapper -> IOUtils.copy(responseWrapper.getInputStream(), response.getOutputStream()));
+            } catch (HttpClientErrorException e) {
+                // 捕获 HTTP 4xx 错误（如 404）
+                logger.error("HTTP 请求失败，状态码：{}，url：{}", e.getStatusCode(), urlPath);
+                try {
+                    if (e.getStatusCode().is4xxClientError()) {
+                        response.sendError(e.getStatusCode().value(), "文件不存在或无法访问");
+                    } else {
+                        response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "下载文件时发生错误");
+                    }
+                } catch (IOException ignored) {
+                }
+            } catch (Exception e) {
+                // 捕获其他异常（如连接超时、IO 异常等）
+                logger.error("读取跨域文件异常，url：{}", urlPath, e);
+                try {
+                    response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "读取文件失败: " + e.getMessage());
+                } catch (IOException ignored) {
+                }
+            }
        } else {
+            // FTP 处理
+            InputStream inputStream = null;
            try {
                String filename = urlPath.substring(urlPath.lastIndexOf('/') + 1);
                String contentType = WebUtils.getContentTypeByFilename(filename);
@@ -190,10 +229,23 @@ public class OnlinePreviewController {
                String ftpPassword = WebUtils.getUrlParameterReg(urlPath, URL_PARAM_FTP_PASSWORD);
                String ftpControlEncoding = WebUtils.getUrlParameterReg(urlPath, URL_PARAM_FTP_CONTROL_ENCODING);
                String support = WebUtils.getUrlParameterReg(urlPath, URL_PARAM_FTP_PORT);
-                inputStream=  FtpUtils.preview(urlPath,support, urlPath, ftpUsername, ftpPassword, ftpControlEncoding);
+                inputStream = FtpUtils.preview(urlPath, support, urlPath, ftpUsername, ftpPassword, ftpControlEncoding);
                IOUtils.copy(inputStream, response.getOutputStream());
            } catch (IOException e) {
-                logger.error("读取跨域文件异常，url：{}", urlPath);
+                logger.error("读取跨域文件异常，url：{}", urlPath, e);
+                try {
+                    // 根据异常信息判断是否为文件不存在
+                    if (e.getMessage() != null && (e.getMessage().contains("550") || e.getMessage().contains("File not found"))) {
+                        response.sendError(HttpServletResponse.SC_NOT_FOUND, "FTP 文件不存在");
+                    } else {
+                        response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "FTP 读取失败");
+                    }
+                } catch (IOException ignored) {}
+            } catch (Exception e) {
+                logger.error("FTP 预览发生未知异常，url：{}", urlPath, e);
+                try {
+                    response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "FTP 服务异常");
+                } catch (IOException ignored) {}
            } finally {
                IOUtils.closeQuietly(inputStream);
            }
--- a/server/src/main/java/cn/keking/web/filter/AttributeSetFilter.java
+++ b/server/src/main/java/cn/keking/web/filter/AttributeSetFilter.java
@@ -38,6 +38,7 @@ public class AttributeSetFilter implements Filter {
        request.setAttribute("pdfDownloadDisable", ConfigConstants.getPdfDownloadDisable());
        request.setAttribute("pdfBookmarkDisable", ConfigConstants.getPdfBookmarkDisable());
        request.setAttribute("pdfDisableEditing", ConfigConstants.getPdfDisableEditing());
+        request.setAttribute("pdfSidebarOpen", ConfigConstants.getPdfSidebarOpen());
        request.setAttribute("switchDisabled", ConfigConstants.getOfficePreviewSwitchDisabled());
        request.setAttribute("fileUploadDisable", ConfigConstants.getFileUploadDisable());
        request.setAttribute("beian", ConfigConstants.getBeian());
--- a/server/src/main/resources/static/css/main-pages.css
+++ b/server/src/main/resources/static/css/main-pages.css
--- a/server/src/main/resources/static/images/hero-icons/excel.svg
+++ b/server/src/main/resources/static/images/hero-icons/excel.svg
@@ -0,0 +1 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Microsoft Excel</title><path d="M23 1.5q.41 0 .7.3.3.29.3.7v19q0 .41-.3.7-.29.3-.7.3H7q-.41 0-.7-.3-.3-.29-.3-.7V18H1q-.41 0-.7-.3-.3-.29-.3-.7V7q0-.41.3-.7Q.58 6 1 6h5V2.5q0-.41.3-.7.29-.3.7-.3zM6 13.28l1.42 2.66h2.14l-2.38-3.87 2.34-3.8H7.46l-1.3 2.4-.05.08-.04.09-.64-1.28-.66-1.29H2.59l2.27 3.82-2.48 3.85h2.16zM14.25 21v-3H7.5v3zm0-4.5v-3.75H12v3.75zm0-5.25V7.5H12v3.75zm0-5.25V3H7.5v3zm8.25 15v-3h-6.75v3zm0-4.5v-3.75h-6.75v3.75zm0-5.25V7.5h-6.75v3.75zm0-5.25V3h-6.75v3Z"/></svg>
--- a/server/src/main/resources/static/images/hero-icons/pdf.svg
+++ b/server/src/main/resources/static/images/hero-icons/pdf.svg
@@ -0,0 +1 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Adobe Acrobat Reader</title><path d="M23.63 15.3c-.71-.745-2.166-1.17-4.224-1.17-1.1 0-2.377.106-3.761.354a19.443 19.443 0 0 1-2.307-2.661c-.532-.71-.994-1.49-1.42-2.236.817-2.484 1.207-4.507 1.207-5.962 0-1.632-.603-3.336-2.342-3.336-.532 0-1.065.32-1.349.781-.78 1.384-.425 4.4.923 7.381a60.277 60.277 0 0 1-1.703 4.507c-.568 1.349-1.207 2.733-1.917 4.01C2.834 18.53.314 20.34.03 21.758c-.106.533.071 1.03.462 1.42.142.107.639.533 1.49.533 2.59 0 5.323-4.188 6.707-6.707 1.065-.355 2.13-.71 3.194-.994a34.963 34.963 0 0 1 3.407-.745c2.732 2.448 5.145 2.839 6.352 2.839 1.49 0 2.023-.604 2.2-1.1.32-.64.106-1.349-.213-1.704zm-1.42 1.03c-.107.532-.64.887-1.384.887-.213 0-.39-.036-.604-.071-1.348-.32-2.626-.994-3.903-2.059a17.717 17.717 0 0 1 2.98-.248c.746 0 1.385.035 1.81.142.497.106 1.278.426 1.1 1.348zm-7.524-1.668a38.01 38.01 0 0 0-2.945.674 39.68 39.68 0 0 0-2.52.745 40.05 40.05 0 0 0 1.207-2.555c.426-.994.78-2.023 1.136-2.981.354.603.745 1.207 1.135 1.739a50.127 50.127 0 0 0 1.987 2.378zM10.038 1.46a.768.768 0 0 1 .674-.425c.745 0 .887.851.887 1.526 0 1.135-.355 2.874-.958 4.861-1.03-2.768-1.1-5.074-.603-5.962zM6.134 17.997c-1.81 2.981-3.549 4.826-4.613 4.826a.872.872 0 0 1-.532-.177c-.213-.213-.32-.461-.249-.745.213-1.065 2.271-2.555 5.394-3.904Z"/></svg>
--- a/server/src/main/resources/static/images/hero-icons/powerpoint.svg
+++ b/server/src/main/resources/static/images/hero-icons/powerpoint.svg
@@ -0,0 +1 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Microsoft PowerPoint</title><path d="M13.5 1.5q1.453 0 2.795.375 1.342.375 2.508 1.06 1.166.686 2.12 1.641.956.955 1.641 2.121.686 1.166 1.061 2.508Q24 10.547 24 12q0 1.453-.375 2.795-.375 1.342-1.06 2.508-.686 1.166-1.641 2.12-.955.956-2.121 1.641-1.166.686-2.508 1.061-1.342.375-2.795.375-1.29 0-2.52-.305-1.23-.304-2.337-.884-1.108-.58-2.063-1.418-.955-.838-1.693-1.893H.997q-.411 0-.704-.293T0 17.004V6.996q0-.41.293-.703T.996 6h3.89q.739-1.055 1.694-1.893.955-.837 2.063-1.418 1.107-.58 2.337-.884Q12.21 1.5 13.5 1.5zm.75 1.535v8.215h8.215q-.14-1.64-.826-3.076-.686-1.436-1.782-2.531-1.095-1.096-2.537-1.782-1.441-.685-3.07-.826zm-5.262 7.57q0-.68-.228-1.166-.229-.486-.627-.79-.399-.305-.938-.446-.539-.14-1.172-.14H2.848v7.863h1.84v-2.742H5.93q.574 0 1.119-.17t.978-.493q.434-.322.698-.802.263-.48.263-1.114zM13.5 21q1.172 0 2.262-.287t2.056-.82q.967-.534 1.776-1.278.808-.744 1.418-1.664.61-.92.984-1.986.375-1.067.469-2.227h-9.703V3.035q-1.735.14-3.27.908T6.797 6h4.207q.41 0 .703.293t.293.703v10.008q0 .41-.293.703t-.703.293H6.797q.644.715 1.412 1.271.768.557 1.623.944.855.387 1.781.586Q12.54 21 13.5 21zM5.812 9.598q.575 0 .915.228.34.229.34.838 0 .27-.124.44-.123.17-.31.275-.188.105-.422.146-.234.041-.445.041H4.687V9.598Z"/></svg>
--- a/server/src/main/resources/static/images/hero-icons/word.svg
+++ b/server/src/main/resources/static/images/hero-icons/word.svg
@@ -0,0 +1 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Microsoft Word</title><path d="M23.004 1.5q.41 0 .703.293t.293.703v19.008q0 .41-.293.703t-.703.293H6.996q-.41 0-.703-.293T6 21.504V18H.996q-.41 0-.703-.293T0 17.004V6.996q0-.41.293-.703T.996 6H6V2.496q0-.41.293-.703t.703-.293zM6.035 11.203l1.442 4.735h1.64l1.57-7.876H9.036l-.937 4.653-1.325-4.5H5.38l-1.406 4.523-.938-4.675H1.312l1.57 7.874h1.641zM22.5 21v-3h-15v3zm0-4.5v-3.75H12v3.75zm0-5.25V7.5H12v3.75zm0-5.25V3h-15v3Z"/></svg>
--- a/server/src/main/resources/static/js/pdfwatermark.js
+++ b/server/src/main/resources/static/js/pdfwatermark.js
@@ -1,69 +0,0 @@
-
-function isNotEmpty(value) {
-  return value !== null && value !== undefined && value !== '' && value !== 'false' ;
-}
-
-function watermarkObj(watermarkContainer,watermarkTxt) {
-try {
-if (!isNotEmpty(watermarkTxt)) {
-    return ;
-}
-		var watermarkSettings = {
-			watermark_txt: watermarkTxt,
-			watermark_start_x:80,//水印起始位置x轴坐标
-			watermark_start_y:80,//水印起始位置Y轴坐标
-			watermark_x_space:80,//水印x轴间隔
-			watermark_y_space:80,//水印y轴间隔
-			watermark_color:'black',//水印字体颜色
-			watermark_alpha:0.2,//水印透明度
-			watermark_fontsize:'18px',//水印字体大小
-			watermark_font:'微软雅黑',//水印字体
-			watermark_width:200,//水印宽度
-			watermark_height:80,//水印高度
-			watermark_angle:30//水印倾斜度数
-		};
-	//	console.log(watermarkContainer);
-		var page_width = $(watermarkContainer).width() - watermarkSettings.watermark_width;
-		var page_height = $(watermarkContainer).height() - watermarkSettings.watermark_height;
-        page_width = (page_width < 250) ? 250 : page_width;
-        page_height = (page_height < 250) ? 250 : page_height;
-		var oTemp = document.createDocumentFragment();
-		for (var x = watermarkSettings.watermark_start_x; x < page_width; x+= watermarkSettings.watermark_x_space) {
-			for (var y = watermarkSettings.watermark_start_y; y < page_height; y+= watermarkSettings.watermark_y_space) {
-				var mask_div = document.createElement('div');
-				// mask_div.id = 'mask_div' + x + y;
-				mask_div.className = 'mask_div';
-				mask_div.appendChild(document.createTextNode(watermarkTxt));
-				// 设置水印div倾斜显示
-				mask_div.style.filter = "progid:DXImageTransform.Microsoft.Alpha(opacity="+(watermarkSettings.watermark_alpha*100)+")";
-				mask_div.style.webkitTransform = "rotate(-" + watermarkSettings.watermark_angle + "deg)";
-				mask_div.style.MozTransform = "rotate(-" + watermarkSettings.watermark_angle + "deg)";
-				mask_div.style.msTransform = "rotate(-" + watermarkSettings.watermark_angle + "deg)";
-				mask_div.style.OTransform = "rotate(-" + watermarkSettings.watermark_angle + "deg)";
-				mask_div.style.transform = "rotate(-" + watermarkSettings.watermark_angle + "deg)";
-				mask_div.style.visibility = "";
-				mask_div.style.position = "absolute";
-				mask_div.style.left = x + 'px';
-				mask_div.style.top = y + 'px';
-				mask_div.style.overflow = "hidden";
-				mask_div.style.zIndex = "100";
-				mask_div.style.pointerEvents='none';//pointer-events:none  让水印不遮挡页面的点击事件
-				//mask_div.style.border="solid #eee 1px";
-				mask_div.style.opacity = watermarkSettings.watermark_alpha;
-				mask_div.style.fontSize = watermarkSettings.watermark_fontsize;
-				mask_div.style.fontFamily = watermarkSettings.watermark_font;
-				mask_div.style.color = watermarkSettings.watermark_color;
-				mask_div.style.textAlign = "center";
-				mask_div.style.width = watermarkSettings.watermark_width + 'px';
-				mask_div.style.height = watermarkSettings.watermark_height + 'px';
-				mask_div.style.display = "block";
-				oTemp.appendChild(mask_div);
-			}
-		}
-        $(watermarkContainer).append(oTemp);
-	} catch (e) {
-	console.log(e);
-	}
-	
-}
-
--- a/server/src/main/resources/static/pdfjs/web/viewer.html
+++ b/server/src/main/resources/static/pdfjs/web/viewer.html
@@ -1221,8 +1221,6 @@ See https://github.com/adobe-type-tools/cmap-resources
      <!-- editorUndoBar -->
    </div>
    <!-- outerContainer -->
-	<script type="text/javascript" src="/js/jquery-3.6.1.min.js"></script>
-    <script type="text/javascript" src="/js/pdfwatermark.js"></script>
    <div id="printContainer"></div>
  </body>
 </html>
--- a/server/src/main/resources/static/pdfjs/web/viewer.mjs
+++ b/server/src/main/resources/static/pdfjs/web/viewer.mjs
@@ -1,5 +1,18 @@
 var kkhighlightAll;
 var watermarkTxt;
+var watermarkSettings = {
+    start_x: 80,
+    start_y: 80,
+    x_space: 80,
+    y_space: 80,
+    color: 'black',
+    alpha: 0.2,
+    fontsize: '18px',
+    font: '微软雅黑',
+    width: 200,
+    height: 80,
+    angle: 30
+};
 const queryString = document.location.search.substring(1);
 const params = (0, parseQueryString)(queryString);

@@ -9,6 +22,94 @@ if (kkpdfAutoFetch == "true") {
 } else {
    kkpdfAutoFetch = false
 }
+
+function isNotEmpty(value) {
+  return value !== null && value !== undefined && value !== '' && value !== 'false' ;
+}
+
+function getWatermarkStringParam(params, name, fallback) {
+    const value = params.get(name);
+    return isNotEmpty(value) ? value : fallback;
+}
+
+function getWatermarkNumberParam(params, name, fallback, isValid) {
+    const rawValue = params.get(name);
+    if (!isNotEmpty(rawValue)) return fallback;
+    const value = Number(rawValue);
+    return Number.isFinite(value) && isValid(value) ? value : fallback;
+}
+
+function configureWatermark(params) {
+    watermarkSettings.x_space = getWatermarkNumberParam(params, "watermarkxspace", watermarkSettings.x_space, value => value >= 0);
+    watermarkSettings.y_space = getWatermarkNumberParam(params, "watermarkyspace", watermarkSettings.y_space, value => value >= 0);
+    watermarkSettings.font = getWatermarkStringParam(params, "watermarkfont", watermarkSettings.font);
+    watermarkSettings.fontsize = getWatermarkStringParam(params, "watermarkfontsize", watermarkSettings.fontsize);
+    watermarkSettings.color = getWatermarkStringParam(params, "watermarkcolor", watermarkSettings.color);
+    watermarkSettings.alpha = getWatermarkNumberParam(params, "watermarkalpha", watermarkSettings.alpha, value => value >= 0 && value <= 1);
+    watermarkSettings.width = getWatermarkNumberParam(params, "watermarkwidth", watermarkSettings.width, value => value > 0);
+    watermarkSettings.height = getWatermarkNumberParam(params, "watermarkheight", watermarkSettings.height, value => value > 0);
+    watermarkSettings.angle = getWatermarkNumberParam(params, "watermarkangle", watermarkSettings.angle, Number.isFinite);
+}
+/**
+ * 通用水印生成函数
+ * @param {HTMLElement} container   - 水印容器（相对定位的父元素）
+ * @param {string} watermarkTxt     - 水印文字
+ * @param {number} [explicitWidth]  - 可选：显式指定容器宽度（px），不传则自动获取
+ * @param {number} [explicitHeight] - 可选：显式指定容器高度（px），不传则自动获取
+ */
+function addWatermark(container, watermarkTxt, explicitWidth = null, explicitHeight = null) {
+    if (!isNotEmpty(watermarkTxt)) return;
+
+    const settings = watermarkSettings;
+
+    // 确定实际使用的宽高
+    let pageWidth, pageHeight;
+    if (explicitWidth !== null && explicitHeight !== null) {
+        pageWidth = explicitWidth;
+        pageHeight = explicitHeight;
+    } else {
+        const rect = container.getBoundingClientRect();
+        pageWidth = rect.width;
+        pageHeight = rect.height;
+    }
+
+    let maxX = pageWidth - settings.width;
+    let maxY = pageHeight - settings.height;
+    maxX = Math.max(maxX, 250);
+    maxY = Math.max(maxY, 250);
+
+    const fragment = document.createDocumentFragment();
+    const xStep = settings.width + settings.x_space;
+    const yStep = settings.height + settings.y_space;
+    for (let x = settings.start_x; x < maxX; x += xStep) {
+        for (let y = settings.start_y; y < maxY; y += yStep) {
+            const div = document.createElement('div');
+            div.className = 'mask_div';
+            div.appendChild(document.createTextNode(watermarkTxt));
+            div.style.filter = `progid:DXImageTransform.Microsoft.Alpha(opacity=${settings.alpha * 100})`;
+            div.style.transform = `rotate(-${settings.angle}deg)`;
+            div.style.visibility = 'visible';
+            div.style.position = 'absolute';
+            div.style.left = `${x}px`;
+            div.style.top = `${y}px`;
+            div.style.overflow = 'hidden';
+            div.style.zIndex = '100';
+            div.style.pointerEvents = 'none';
+            div.style.opacity = settings.alpha;
+            div.style.fontSize = settings.fontsize;
+            div.style.fontFamily = settings.font;
+            div.style.color = settings.color;
+            div.style.textAlign = 'center';
+            div.style.width = `${settings.width}px`;
+            div.style.height = `${settings.height}px`;
+            div.style.display = 'block';
+            fragment.appendChild(div);
+        }
+    }
+    container.appendChild(fragment);
+}
+
+
 /******/ var __webpack_modules__ = ({

 /***/ 34:
@@ -13874,37 +13975,43 @@ class PDFPrintService {
    };
    return new Promise(renderNextPage);
  }
-  useRenderedPage() {
+useRenderedPage() {
    this.throwIfInactive();
    const img = document.createElement("img");
-    this.scratchCanvas.toBlob(blob => {
-      img.src = URL.createObjectURL(blob);
-    });
    const wrapper = document.createElement("div");
    wrapper.className = "printedPage";
+    wrapper.style.position = "relative";
+    
+    // 获取当前页面的尺寸（单位：点，1pt=1/72英寸）
+    const pageSizePt = this.pagesOverview[0];
+    // 转换为 CSS 像素（1pt = 96/72 px）
+    const pageWidthPx = pageSizePt.width * 96 / 72;
+    const pageHeightPx = pageSizePt.height * 96 / 72;
+    
+    // 设置 wrapper 尺寸（CSS 像素）
+    wrapper.style.width = `${pageWidthPx}px`;
+    wrapper.style.height = `${pageHeightPx}px`;
+    wrapper.style.backgroundColor = "white";
+    
+    this.scratchCanvas.toBlob(blob => {
+        img.src = URL.createObjectURL(blob);
+    });
+    
    wrapper.append(img);
-	 var printWatermarkDiv = document.createElement('div');
-    // console.log(pageSize);
-    printWatermarkDiv.style.position = 'absolute';
-    printWatermarkDiv.style.left = '0px';
-    printWatermarkDiv.style.top = '0px';
-    printWatermarkDiv.style.width = '1024px';
-    printWatermarkDiv.style.height = pageSize.height*pageCount+ "px";
-    watermarkObj(printWatermarkDiv,watermarkTxt);
-    wrapper.appendChild(printWatermarkDiv);
    this.printContainer.append(wrapper);
-    const {
-      promise,
-      resolve,
-      reject
-    } = Promise.withResolvers();
-    img.onload = resolve;
+    
+    const { promise, resolve, reject } = Promise.withResolvers();
+    img.onload = () => {
+        // 使用专用函数生成水印，直接传入页面像素尺寸
+        addWatermark(wrapper, watermarkTxt, pageWidthPx, pageHeightPx);
+        resolve();
+    };
    img.onerror = reject;
    promise.catch(() => {}).then(() => {
-      URL.revokeObjectURL(img.src);
+        URL.revokeObjectURL(img.src);
    });
    return promise;
-  }
+}
  performPrint() {
    this.throwIfInactive();
    return new Promise(resolve => {
@@ -17612,7 +17719,7 @@ class PDFPageView extends BasePDFPageView {
        }
      });
    }
-	watermarkObj(div,watermarkTxt);
+	addWatermark(div,watermarkTxt);
    if (!this.annotationLayer && this.#annotationMode !== AnnotationMode.DISABLE) {
      const {
        annotationStorage,
@@ -21986,7 +22093,8 @@ const PDFViewerApplication = {
    disableBookmark = params.get("disablebookmark") ?? 'false';
    disableEditing = params.get("disableediting") ?? 'false';
    kkhighlightAll = params.get("pdfhighlightall") ?? 'false';
-    watermarkTxt= params.get('watermarktxt') ?? 'false';
+    watermarkTxt = params.get('watermarktxt') ?? 'false';
+    configureWatermark(params);
    try {
      file = new URL(file).href;
    } catch {
@@ -23083,24 +23191,26 @@ initCom(PDFViewerApplication);
 }
 {
  const HOSTED_VIEWER_ORIGINS = new Set(["null", "http://mozilla.github.io", "https://mozilla.github.io"]);
-  var validateFileURL = function (file) {
-    if (!file) {
-      return;
-    }
-    const viewerOrigin = URL.parse(window.location)?.origin || "null";
-    if (HOSTED_VIEWER_ORIGINS.has(viewerOrigin)) {
-      return;
-    }
-    const fileOrigin = URL.parse(file, window.location)?.origin;
-    if (fileOrigin === viewerOrigin) {
-      return;
-    }
-    const ex = new Error("file origin does not match viewer's");
-    PDFViewerApplication._documentError("pdfjs-loading-error", {
-      message: ex.message
-    });
-    throw ex;
-  };
+var validateFileURL = function (file) {
+  if (!file) {
+    return;
+  }
+  const viewerOrigin = URL.parse(window.location)?.origin || "null";
+  if (HOSTED_VIEWER_ORIGINS.has(viewerOrigin)) {
+    return;
+  }
+  /* 注释掉跨域检查
+  const fileOrigin = URL.parse(file, window.location)?.origin;
+  if (fileOrigin === viewerOrigin) {
+    return;
+  }
+  const ex = new Error("file origin does not match viewer's");
+  PDFViewerApplication._documentError("pdfjs-loading-error", {
+    message: ex.message
+  });
+  throw ex;
+  */
+};
  var onFileInputChange = function (evt) {
    if (this.pdfViewer?.isInPresentationMode) {
      return;
--- a/server/src/main/resources/static/xlsx/luckyexcel-worker.js
+++ b/server/src/main/resources/static/xlsx/luckyexcel-worker.js
@@ -0,0 +1,54 @@
+// LuckyExcel's bundled getBinaryContent reads window.XMLHttpRequest.
+// Web Worker exposes XMLHttpRequest on self, so provide a minimal window alias
+// before loading the UMD bundle.
+self.window = self;
+
+importScripts('./luckyexcel.umd.js');
+
+self.console.log = function () {};
+
+self.onmessage = function (event) {
+    var data = event.data || {};
+    var url = data.url;
+    var name = data.name;
+
+    if (!url) {
+        self.postMessage({
+            type: 'error',
+            message: '文件URL为空'
+        });
+        return;
+    }
+
+    try {
+        LuckyExcel.transformExcelToLuckyByUrl(
+            url,
+            name,
+            function (exportJson, luckysheetfile) {
+                if (!exportJson || !exportJson.sheets || exportJson.sheets.length === 0) {
+                    self.postMessage({
+                        type: 'error',
+                        message: '读取excel文件内容失败!'
+                    });
+                    return;
+                }
+
+                self.postMessage({
+                    type: 'success',
+                    exportJson: exportJson
+                });
+            },
+            function (error) {
+                self.postMessage({
+                    type: 'error',
+                    message: error && error.message ? error.message : String(error)
+                });
+            }
+        );
+    } catch (error) {
+        self.postMessage({
+            type: 'error',
+            message: error && error.message ? error.message : String(error)
+        });
+    }
+};
--- a/server/src/main/resources/static/xlsx/luckyexcel.umd.js
+++ b/server/src/main/resources/static/xlsx/luckyexcel.umd.js
@@ -3938,7 +3938,7 @@ var LuckySheet = /** @class */function (_super) {
    _this.sheetList = allFileOption.sheetList;
    _this.imageList = allFileOption.imageList;
    _this.hide = allFileOption.hide;
-    console.log(allFileOption, 'allFileOption');
+    // console.log(allFileOption, 'allFileOption');
    _this.dataVerificationSelectCount = allFileOption.dataVerificationSelectCount;
    //Output
    _this.name = sheetName;
@@ -4433,7 +4433,8 @@ var LuckySheet = /** @class */function (_super) {
      var _hint = method_1.getXmlAttibute(attrList, "prompt", null);
      var _hintShow = _hint ? true : false;
      var matchType = constant_1.COMMON_TYPE2.includes(_type) ? "common" : _type;
-      _type2 = operator ? constant_1.DATA_VERIFICATION_TYPE2_MAP[matchType][operator] : "bw";
+      var _type2Map = constant_1.DATA_VERIFICATION_TYPE2_MAP[matchType];
+      _type2 = operator ? (_type2Map ? _type2Map[operator] : "bw") : "bw";
      // mobile phone number processing
      if (_type === "text_content" && ((_value1 === null || _value1 === void 0 ? void 0 : _value1.includes("LEN")) || (_value1 === null || _value1 === void 0 ? void 0 : _value1.includes("len"))) && (_value1 === null || _value1 === void 0 ? void 0 : _value1.includes("=11"))) {
        _type = "validity";
@@ -7421,4 +7422,3 @@ module.exports = main_1.LuckyExcel;

 },{"./main":19}]},{},[20])(20)
 });
-
--- a/server/src/main/resources/web/code.ftl
+++ b/server/src/main/resources/web/code.ftl
@@ -16,6 +16,22 @@
    <script src="js/jsformat.js" type="text/javascript"></script>
    </#if>
    <script src="js/base64.min.js" type="text/javascript"></script>
+    <style>
+        #htmlPreviewFrame {
+            width: 100%;
+            min-height: 65vh;
+            border: 0;
+            background: #fff;
+        }
+        #htmlSource {
+            min-height: 65vh;
+            overflow: auto;
+            border: 0;
+            background: #fff;
+            white-space: pre-wrap;
+            word-break: break-word;
+        }
+    </style>
 </head>
 <body>
 <input hidden id="textData" value="${textData}"/>
@@ -25,7 +41,7 @@
    <div class="panel panel-default">
        <div class="panel-heading"> 
            <h4 class="panel-title"> 
-                <strong><font color="red"><input class="GLOkBtn" type="button" value="运行html" onclick="loadXmlData();" /></font></strong>
+                <strong><font color="red"><input class="GLOkBtn" type="button" value="在沙箱中运行html" onclick="loadXmlData();" /></font></strong>
                <a data-toggle="collapse" data-parent="#accordion" onclick="loadText();">
                    ${file.name}   
                </a>
@@ -40,57 +56,42 @@
    // 将Freemarker的布尔值传递给JavaScript
    var scriptjs = ${scriptjs?c}; // ?c 将布尔值转换为字符串true/false

+    function decodePreviewText() {
+        var escapedText = Base64.decode($("#textData").val());
+        var decoder = document.createElement("textarea");
+        decoder.innerHTML = escapedText;
+        return decoder.value;
+    }
+
+    function replacePreviewContent(element) {
+        var container = document.getElementById("text");
+        while (container.firstChild) {
+            container.removeChild(container.firstChild);
+        }
+        container.appendChild(element);
+    }
+    
    /**
     *加载普通文本
     */
    function loadText() {
-        var base64data = $("#textData").val()
-        var div = document.getElementById("text");
-        div.innerHTML = ""; //
-        var textData = Base64.decode(base64data);
-        textData = htmlttt(textData,1);
-        var textPreData = "<xmp style='background-color: #FFFFFF;overflow-y: scroll;border:none'>" + textData + "</xmp>";
-        $("#text").append(textPreData);
-    }
-    
-    function htmlttt (str,txt){ 
-        var s = "";
-        if(str.length == 0) return "";
-        s = str.replace(/&amp;/gi,"&");
-        s = s.replace(/&lt;/gi,"<");
-        s = s.replace(/&gt;/gi,">");
-        s = s.replace(/&nbsp;/gi," ");
-        s = s.replace(/&#39;/gi,"\'");
-        s = s.replace(/&quot;/gi,"\""); 
-        s = s.replace(/javascript/g,"javascript ");
-        if (txt === 2){
-            s = s.replace(/<script/gi, "&lt;script ");
-            s = s.replace(/javascript/g,"javascript ");
-            s = s.replace(/<\/script/gi, "&lt;/script ");
-            s = s.replace(/<iframe/gi, "&lt;iframe ");
-            s = s.replace(/<\/iframe/gi, "&lt;/iframe ");
-            s = s.replace(/confirm/gi, "c&onfirm");
-            s = s.replace(/alert/gi, "a&lert");
-            s = s.replace(/eval/gi, "e&val");
-        }
-        return s;  
+        var source = document.createElement("pre");
+        source.id = "htmlSource";
+        source.textContent = decodePreviewText();
+        replacePreviewContent(source);
    }
    
    /**
     *加载运行
     */
    function loadXmlData() {
-        var base64data = $("#textData").val();
-        var textData = Base64.decode(base64data);
-        
-        // 直接使用JavaScript变量进行判断
-        if (scriptjs) {
-            textData = htmlttt(textData, 1);
-        } else {
-            textData = htmlttt(textData, 2);
-        }
-        
-        $('#text').html(textData);
+        var frame = document.createElement("iframe");
+        frame.id = "htmlPreviewFrame";
+        frame.title = "HTML sandbox preview";
+        frame.setAttribute("sandbox", scriptjs ? "allow-scripts" : "");
+        frame.setAttribute("referrerpolicy", "no-referrer");
+        frame.srcdoc = decodePreviewText();
+        replacePreviewContent(frame);
    }
    
    /**
--- a/server/src/main/resources/web/compress.ftl
+++ b/server/src/main/resources/web/compress.ftl
--- a/server/src/main/resources/web/main/contact.ftl
+++ b/server/src/main/resources/web/main/contact.ftl
@@ -0,0 +1,104 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="utf-8"/>
+    <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
+    <title>kkFileView 技术支持</title>
+    <link rel="icon" href="./favicon.ico" type="image/x-icon">
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:wght@400;500;600;700&family=JetBrains+Mono:wght@400;600&family=Space+Grotesk:wght@500;700&display=swap" rel="stylesheet">
+    <link rel="stylesheet" href="bootstrap/css/bootstrap.min.css"/>
+    <link rel="stylesheet" href="css/theme.css"/>
+    <link rel="stylesheet" href="css/main-pages.css"/>
+    <script type="text/javascript" src="js/jquery-3.6.1.min.js"></script>
+    <script type="text/javascript" src="bootstrap/js/bootstrap.min.js"></script>
+</head>
+
+<body class="app-shell">
+<nav class="site-nav navbar navbar-inverse navbar-fixed-top">
+    <div class="container">
+        <div class="navbar-header">
+            <a class="navbar-brand" href="https://kkview.cn" target="_blank">kkFileView</a>
+        </div>
+        <ul class="nav navbar-nav">
+            <li><a href="./index">首页</a></li>
+            <li><a href="./integrated">接入说明</a></li>
+            <li><a href="./record">版本发布记录</a></li>
+            <li><a href="./sponsor">赞助开源</a></li>
+            <li class="active"><a href="./contact">技术支持</a></li>
+        </ul>
+    </div>
+</nav>
+
+<div class="page-shell">
+    <div class="container" role="main">
+        <section class="hero-section release-hero">
+            <div class="hero-copy">
+                <div class="contact-hero-layout">
+                    <div class="contact-hero-copy">
+                    <span class="eyebrow">Contact Us</span>
+                <h1 class="hero-title">技术支持</h1>
+                    <p class="hero-subtitle">
+                        如果你在部署、安装、接入或日常使用 kkFileView 时需要更直接的支持，
+                        可以加入我们的付费知识星球，获取安装使用技术支持。
+                    </p>
+                    <div class="hero-actions">
+                        <a class="hero-link primary" href="https://wx.zsxq.com/group/48844125114258" target="_blank">加入知识星球</a>
+                        <a class="hero-link secondary" href="./integrated">查看接入说明</a>
+                    </div>
+                    </div>
+                    <div class="contact-hero-side">
+                    <div class="support-summary">
+                        <div class="support-summary-item">
+                            <span class="tag brand">安装支持</span>
+                            <p>提供最新的安装发行包，公示安全补丁等。</p>
+                        </div>
+                        <div class="support-summary-item">
+                            <span class="tag">使用咨询</span>
+                            <p>围绕接入、配置和日常使用问题提供支持。</p>
+                        </div>
+                        <div class="support-summary-item">
+                            <span class="tag highlight">付费知识星球</span>
+                            <p>通过知识星球联系，我们提供更直接的技术支持。</p>
+                        </div>
+                    </div>
+                    </div>
+                </div>
+            </div>
+        </section>
+
+        <div class="sponsor-grid">
+            <section class="doc-card">
+                <div class="doc-card-header">
+                    <div>
+                        <span class="eyebrow">Support Scope</span>
+                        <h3>支持内容</h3>
+                    </div>
+                </div>
+                <p>如果你希望更快完成部署和落地，可以通过知识星球联系我们，获得更直接的安装使用支持。</p>
+                <ul>
+                    <li>安装部署相关问题。</li>
+                    <li>配置、接入和常见使用问题。</li>
+                    <li>围绕实际使用场景的排查与建议。</li>
+                </ul>
+            </section>
+
+            <section class="doc-card">
+                <div class="doc-card-header">
+                    <div>
+                        <span class="eyebrow">Knowledge Planet</span>
+                        <h3>加入方式</h3>
+                    </div>
+                </div>
+                <p>知识星球地址：</p>
+                <p><a href="https://wx.zsxq.com/group/48844125114258" target="_blank">https://wx.zsxq.com/group/48844125114258</a></p>
+                <div class="note-row">
+                    <span class="tag brand"><a href="https://wx.zsxq.com/group/48844125114258" target="_blank">立即加入</a></span>
+                </div>
+            </section>
+        </div>
+    </div>
+</div>
+</body>
+</html>
--- a/server/src/main/resources/web/main/index.ftl
+++ b/server/src/main/resources/web/main/index.ftl
--- a/server/src/main/resources/web/main/integrated.ftl
+++ b/server/src/main/resources/web/main/integrated.ftl
@@ -1,118 +1,254 @@
 <!DOCTYPE html>
-
-<html lang="en" xmlns="http://www.w3.org/1999/html">
+<html lang="en">
 <head>
    <meta charset="utf-8"/>
    <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
-    <title>接入说明</title>
+    <title>kkFileView 接入说明</title>
    <link rel="icon" href="./favicon.ico" type="image/x-icon">
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:wght@400;500;600;700&family=JetBrains+Mono:wght@400;600&family=Space+Grotesk:wght@500;700&display=swap" rel="stylesheet">
    <link rel="stylesheet" href="bootstrap/css/bootstrap.min.css"/>
    <link rel="stylesheet" href="css/theme.css"/>
+    <link rel="stylesheet" href="css/main-pages.css"/>
    <script type="text/javascript" src="js/jquery-3.6.1.min.js"></script>
    <script type="text/javascript" src="bootstrap/js/bootstrap.min.js"></script>
+    <script type="text/javascript" src="highlight/highlight.min.js"></script>
 </head>

-<body>
-
-<nav class="navbar navbar-inverse navbar-fixed-top">
+<body class="app-shell">
+<nav class="site-nav navbar navbar-inverse navbar-fixed-top">
    <div class="container">
        <div class="navbar-header">
-            <a class="navbar-brand" href="https://kkview.cn" target='_blank'>kkFileView</a>
+            <a class="navbar-brand" href="https://kkview.cn" target="_blank">kkFileView</a>
        </div>
        <ul class="nav navbar-nav">
            <li><a href="./index">首页</a></li>
            <li class="active"><a href="./integrated">接入说明</a></li>
            <li><a href="./record">版本发布记录</a></li>
            <li><a href="./sponsor">赞助开源</a></li>
+            <li><a href="./contact">技术支持</a></li>
        </ul>
    </div>
 </nav>

-<div class="container theme-showcase" role="main">
-    <#--  接入说明  -->
-    <div class="page-header">
-        <h1>接入说明</h1>
-        本文档针对前端项目接入 kkFileView 的说明，并假设 kkFileView 的服务地址为：http://127.0.0.1:8012。
-    </div>
-    <div class="well">
+<div class="page-shell">
+    <div class="container" role="main">
+        <section class="hero-section release-hero">
+            <div class="hero-copy">
+                <span class="eyebrow">Integration Guide</span>
+                <h1 class="hero-title">5 分钟把 kkFileView 接进你的业务项目。</h1>
+                <p class="hero-subtitle hero-subtitle-inline">
+                    这里按常见接入场景提供示例，方便你直接按需选用。默认假设服务地址为 <span class="text-highlight">${baseUrl}</span>。
+                </p>
+                <div class="note-row">
+                    <span class="tag brand">HTTP / HTTPS</span>
+                    <span class="tag">FTP</span>
+                    <span class="tag highlight">AES</span>
+                    <span class="tag warn">附加参数</span>
+                </div>
+                <div class="summary-grid">
+                    <div class="summary-panel">
+                        <strong>URL</strong>
+                        <span>所有预览能力统一汇总到 `onlinePreview` 入口。</span>
+                    </div>
+                    <div class="summary-panel">
+                        <strong>Base64</strong>
+                        <span>普通接入默认对原始文件地址做 Base64 编码后再传入。</span>
+                    </div>
+                    <div class="summary-panel">
+                        <strong>参数扩展</strong>
+                        <span>支持页码、高亮、水印、密码、跨域、AES 和秘钥等控制项。</span>
+                    </div>
+                </div>
+            </div>
+        </section>

-        <div style="font-size: 16px;">
-            【http/https 资源文件预览】如果你的项目需要接入文件预览项目，达到对docx、excel、ppt、jpg等文件的预览效果，那么通过在你的项目中加入下面的代码就可以成功实现：
-            <p style="background-color: #2f332a;color: #cccccc;font-size: 14px;padding:10px;margin-top:10px;">
-                var url = 'http://127.0.0.1:8080/file/test.txt'; //要预览文件的访问地址 <br>
-                window.open('${baseUrl}onlinePreview?url='+encodeURIComponent(base64Encode(url)));
-            </p>
-        </div>
-        <br>
-        <div style="font-size: 16px;">
-            【http/https 流资源文件预览】很多系统内不是直接暴露文件下载地址，而是请求通过id、code等参数到通过统一的接口，后端通过id或code等参数定位文件，再通过OutputStream输出下载，此时下载url是不带文件后缀名的，预览时需要拿到文件名，传一个参数fullfilename=xxx.xxx来指定文件名，示例如下
-            <p style="background-color: #2f332a;color: #cccccc;font-size: 14px;padding:10px;margin-top:10px;">
-                var originUrl = 'http://127.0.0.1:8080/filedownload?fileId=1'; //要预览文件的访问地址<br>
-                var previewUrl = originUrl + '&fullfilename=test.txt'<br>
-                window.open('${baseUrl}onlinePreview?url='+encodeURIComponent(Base64.encode(previewUrl)));
-            </p>
-        </div>
-        <br>
-         <div style="font-size: 16px;">
-            【ftp 资源文件预览】如果要预览的FTP url是可以匿名访问的（不需要用户名密码），则可以直接通过下载url预览，示例如下
-            <p style="background-color: #2f332a;color: #cccccc;font-size: 14px;padding:10px;margin-top:10px;">
-                var url = 'ftp://127.0.0.1/file/test.txt'; //要预览文件的访问地址<br>
-                window.open('${baseUrl}onlinePreview?url='+encodeURIComponent(Base64.encode(url)));
-            </p>
-        </div>
-        <br>
-        <div style="font-size: 16px;">
-            【ftp 加密资源文件预览】如果 FTP 需要认证访问服，可以通过在 url 中加入用户名密码等参数预览，示例如下
-            <p style="background-color: #2f332a;color: #cccccc;font-size: 14px;padding:10px;margin-top:10px;">
-                var originUrl = 'ftp://127.0.0.1/file/test.txt'; //要预览文件的访问地址<br>
-                var previewUrl = originUrl + '?ftp.control.port=xx&ftp.username=xx&ftp.password=xx&ftp.control.encoding=(gbk,utf8等)'; //(为了安全强烈建议在配置中设置相关信息)<br>
-                window.open('${baseUrl}onlinePreview?url='+encodeURIComponent(Base64.encode(previewUrl)));
-            </p>
-        </div>
-            <div style="font-size: 16px;">
-            【Basic 鉴权资源文件预览】如果需要认证访问服，可以通过在url中加入用户名密码等参数预览，示例如下
-            <p style="background-color: #2f332a;color: #cccccc;font-size: 14px;padding:10px;margin-top:10px;">
-                var originUrl = 'http://127.0.0.1/file/test.txt'; //要预览文件的访问地址<br>
-                var previewUrl = originUrl + '?basic.name=admin&basic.pass=123456'; //(为了安全强烈建议在配置中设置相关信息)<br>
-                window.open('${baseUrl}onlinePreview?url='+encodeURIComponent(Base64.encode(previewUrl)));
-            </p>
-        </div>
-               <div style="font-size: 16px;">
-            AES加密接入方法，示例如下
-            <p style="background-color: #2f332a;color: #cccccc;font-size: 14px;padding:10px;margin-top:10px;">
-              主要事项：首先引入下面js  在把url转换成AES,注意前后端key必须相同（注意：JS下载到你接入服务器的网址）<br>
-            &lt;script src="${baseUrl}js/crypto-js.js"></script><br>
-            &lt;script src="${baseUrl}js/aes.js"></script><br>
-             function aesEncrypt(encryptString, key) { <br>
-             var key = CryptoJS.enc.Utf8.parse(key); <br>
-             var srcs = CryptoJS.enc.Utf8.parse(encryptString); <br>
-             var encrypted = CryptoJS.AES.encrypt(srcs, key, { mode: CryptoJS.mode.ECB, padding: CryptoJS.pad.Pkcs7 }); <br>
-             return encrypted.toString(); <br>
-        }<br>
-            var key = "1234567890123456"; // AES秘钥16位数字<br>
-            var url = "http://127.0.0.1/file/test.txt";<br>
-           window.open('${baseUrl}onlinePreview?url='+encodeURIComponent(aesEncrypt(url, key))+'&encryption=aes');
-            </p>
-        </div>
+        <div class="docs-layout">
+            <aside class="page-toc">
+                <h3>快速导航</h3>
+                <ul>
+                    <li><a href="#quick-start">快速开始</a></li>
+                    <li><a href="#http-preview">HTTP 文件预览</a></li>
+                    <li><a href="#stream-preview">流式接口预览</a></li>
+                    <li><a href="#ftp-preview">FTP 预览</a></li>
+                    <li><a href="#basic-auth">Basic 鉴权</a></li>
+                    <li><a href="#aes-preview">AES 加密</a></li>
+                    <li><a href="#extra-params">附加参数</a></li>
+                </ul>
+            </aside>

-             <div style="font-size: 16px;">
-            其他参数，示例如下 
-            <p style="background-color: #2f332a;color: #cccccc;font-size: 14px;padding:10px;margin-top:10px;">
-            密码参数：&filePassword=加密文件的密码<br>
-            页码参数：&page=选择第几页预览<br>
-            高亮参数：&highlightall=关键字 突出显示 <br>
-            水印参数：&watermarkTxt=你的水印<br>
-            重生参数：&forceUpdatedCache=true <br>
-            跨域参数：&kkagent=true <br>
-            加密缓存：&usePasswordCache=true <br>
-            秘钥参数：&key= 访问秘钥 <br>
-            主要事项：以上参数是把url转换成base64后面在添加<br>
-            var url = 'http://127.0.0.1:8080/file/test.txt'<br>
-           window.open('${baseUrl}onlinePreview?url='+encodeURIComponent(base64Encode(url))+'&filePassword=123&page=1&highlightall=kkfileview&watermarkTxt=kkfileview&kkagent=false&key=123');
-            </p>
+            <div class="docs-content">
+                <section class="doc-card" id="quick-start">
+                    <div class="doc-card-header">
+                        <div>
+                            <span class="eyebrow">Quick Start</span>
+                            <h3>接入思路</h3>
+                        </div>
+                        <div class="tags">
+                            <span class="tag brand">推荐入口</span>
+                        </div>
+                    </div>
+                    <p>前端只需要拿到可访问的文件 URL，然后把它编码后拼到 `${baseUrl}onlinePreview` 上即可。对于大多数业务系统，这是最快的落地路径。</p>
+                    <ul>
+                        <li>普通 HTTP/HTTPS 文件地址：直接 Base64 编码后传入。</li>
+                        <li>下载流接口没有后缀名：补充 `fullfilename=xxx.xxx`。</li>
+                        <li>鉴权或加密场景：附加 Basic、FTP、AES 等参数。</li>
+                    </ul>
+                </section>
+
+                <section class="doc-card" id="http-preview">
+                    <div class="doc-card-header">
+                        <div>
+                            <span class="eyebrow">HTTP / HTTPS</span>
+                            <h3>普通文件地址预览</h3>
+                        </div>
+                        <button class="copy-btn" type="button" onclick="copyCode(this)">复制代码</button>
+                    </div>
+                    <p>适用于系统已经直接暴露出可下载文件地址的情况。前端只需要编码后打开新窗口。</p>
+                    <div class="code-block">
+                        <code class="language-javascript">var url = 'http://127.0.0.1:8080/file/test.txt';
+window.open('${baseUrl}onlinePreview?url=' + encodeURIComponent(base64Encode(url)));</code>
+                    </div>
+                </section>
+
+                <section class="doc-card" id="stream-preview">
+                    <div class="doc-card-header">
+                        <div>
+                            <span class="eyebrow">Streaming</span>
+                            <h3>流式接口预览</h3>
+                        </div>
+                        <button class="copy-btn" type="button" onclick="copyCode(this)">复制代码</button>
+                    </div>
+                    <p>很多业务系统通过 `fileId`、`code` 等参数走统一下载接口，此时原始 URL 没有后缀名，需要额外指定完整文件名。</p>
+                    <div class="code-block">
+                        <code class="language-javascript">var originUrl = 'http://127.0.0.1:8080/filedownload?fileId=1';
+var previewUrl = originUrl + '&amp;fullfilename=test.txt';
+window.open('${baseUrl}onlinePreview?url=' + encodeURIComponent(Base64.encode(previewUrl)));</code>
+                    </div>
+                </section>
+
+                <section class="doc-card" id="ftp-preview">
+                    <div class="doc-card-header">
+                        <div>
+                            <span class="eyebrow">FTP</span>
+                            <h3>FTP 资源预览</h3>
+                        </div>
+                        <button class="copy-btn" type="button" onclick="copyCode(this)">复制代码</button>
+                    </div>
+                    <p>FTP 如果允许匿名访问，可以直接预览；如果需要认证，则把连接参数拼到 URL 后面传入。</p>
+                    <div class="code-block">
+                        <code class="language-javascript">// 匿名 FTP
+var url = 'ftp://127.0.0.1/file/test.txt';
+window.open('${baseUrl}onlinePreview?url=' + encodeURIComponent(Base64.encode(url)));
+
+// 认证 FTP
+var originUrl = 'ftp://127.0.0.1/file/test.txt';
+var previewUrl = originUrl + '?ftp.control.port=21&amp;ftp.username=admin&amp;ftp.password=123456&amp;ftp.control.encoding=utf8';
+window.open('${baseUrl}onlinePreview?url=' + encodeURIComponent(Base64.encode(previewUrl)));</code>
+                    </div>
+                </section>
+
+                <section class="doc-card" id="basic-auth">
+                    <div class="doc-card-header">
+                        <div>
+                            <span class="eyebrow">Basic Auth</span>
+                            <h3>带 Basic 鉴权的 HTTP 资源</h3>
+                        </div>
+                        <button class="copy-btn" type="button" onclick="copyCode(this)">复制代码</button>
+                    </div>
+                    <p>如果文件源本身需要用户名和密码，可以直接把 Basic 鉴权参数拼到地址中，再交给 kkFileView。</p>
+                    <div class="code-block">
+                        <code class="language-javascript">var originUrl = 'http://127.0.0.1/file/test.txt';
+var previewUrl = originUrl + '?basic.name=admin&amp;basic.pass=123456';
+window.open('${baseUrl}onlinePreview?url=' + encodeURIComponent(Base64.encode(previewUrl)));</code>
+                    </div>
+                </section>
+
+                <section class="doc-card" id="aes-preview">
+                    <div class="doc-card-header">
+                        <div>
+                            <span class="eyebrow">AES</span>
+                            <h3>前后端同秘钥加密接入</h3>
+                        </div>
+                        <button class="copy-btn" type="button" onclick="copyCode(this)">复制代码</button>
+                    </div>
+                    <p>如果不希望明文传递原始文件地址，可以在前端先做 AES 加密，再通过 `encryption=aes` 告知服务端按 AES 方式解密。</p>
+                    <div class="code-block">
+                        <code class="language-javascript">&lt;script src="${baseUrl}js/crypto-js.js"&gt;&lt;/script&gt;
+&lt;script src="${baseUrl}js/aes.js"&gt;&lt;/script&gt;
+
+function aesEncrypt(encryptString, key) {
+  var keyBytes = CryptoJS.enc.Utf8.parse(key);
+  var srcs = CryptoJS.enc.Utf8.parse(encryptString);
+  var encrypted = CryptoJS.AES.encrypt(srcs, keyBytes, {
+    mode: CryptoJS.mode.ECB,
+    padding: CryptoJS.pad.Pkcs7
+  });
+  return encrypted.toString();
+}
+
+var key = '1234567890123456';
+var url = 'http://127.0.0.1/file/test.txt';
+window.open('${baseUrl}onlinePreview?url=' + encodeURIComponent(aesEncrypt(url, key)) + '&amp;encryption=aes');</code>
+                    </div>
+                </section>
+
+                <section class="doc-card" id="extra-params">
+                    <div class="doc-card-header">
+                        <div>
+                            <span class="eyebrow">Parameters</span>
+                            <h3>常用附加参数</h3>
+                        </div>
+                        <button class="copy-btn" type="button" onclick="copyCode(this)">复制代码</button>
+                    </div>
+                    <p>这些参数都应该在原始 URL 编码完成之后，再附加到预览地址后面。</p>
+                    <ul>
+                        <li>`filePassword`：加密文件的密码。</li>
+                        <li>`page`：指定预览页码。</li>
+                        <li>`highlightall`：关键字高亮。</li>
+                        <li>`watermarkTxt`：动态水印文本。</li>
+                        <li>`forceUpdatedCache=true`：强制刷新缓存。</li>
+                        <li>`kkagent=true`：需要 kkFileView 代理跨域时启用。</li>
+                        <li>`usePasswordCache=true`：开启密码缓存。</li>
+                        <li>`key`：实例启用秘钥后传入访问秘钥。</li>
+                    </ul>
+                    <div class="code-block">
+                        <code class="language-javascript">var url = 'http://127.0.0.1:8080/file/test.txt';
+window.open(
+  '${baseUrl}onlinePreview?url=' +
+  encodeURIComponent(base64Encode(url)) +
+  '&amp;filePassword=123' +
+  '&amp;page=1' +
+  '&amp;highlightall=kkfileview' +
+  '&amp;watermarkTxt=kkfileview' +
+  '&amp;kkagent=false' +
+  '&amp;key=123'
+);</code>
+                    </div>
+                </section>
+            </div>
        </div>
    </div>
 </div>

+<script>
+    if (window.hljs) {
+        document.querySelectorAll('.code-block code').forEach(function (block) {
+            hljs.highlightBlock(block);
+        });
+    }
+
+    function copyCode(button) {
+        var code = button.parentNode.parentNode.querySelector('code').innerText;
+        var originalText = button.textContent;
+        navigator.clipboard.writeText(code).then(function () {
+            button.textContent = '已复制';
+            setTimeout(function () {
+                button.textContent = originalText;
+            }, 1500);
+        });
+    }
+</script>
 </body>
 </html>
--- a/server/src/main/resources/web/main/record.ftl
+++ b/server/src/main/resources/web/main/record.ftl
--- a/server/src/main/resources/web/main/sponsor.ftl
+++ b/server/src/main/resources/web/main/sponsor.ftl
@@ -1,72 +1,127 @@
 <!DOCTYPE html>
-
-<html lang="en" xmlns="http://www.w3.org/1999/html">
+<html lang="en">
 <head>
    <meta charset="utf-8"/>
    <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
-    <title>赞助开源</title>
+    <title>kkFileView 赞助开源</title>
    <link rel="icon" href="./favicon.ico" type="image/x-icon">
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:wght@400;500;600;700&family=JetBrains+Mono:wght@400;600&family=Space+Grotesk:wght@500;700&display=swap" rel="stylesheet">
    <link rel="stylesheet" href="bootstrap/css/bootstrap.min.css"/>
    <link rel="stylesheet" href="css/theme.css"/>
+    <link rel="stylesheet" href="css/main-pages.css"/>
    <script type="text/javascript" src="js/jquery-3.6.1.min.js"></script>
    <script type="text/javascript" src="bootstrap/js/bootstrap.min.js"></script>
 </head>

-<body>
-
-<!-- Fixed navbar -->
-<nav class="navbar navbar-inverse navbar-fixed-top">
+<body class="app-shell">
+<nav class="site-nav navbar navbar-inverse navbar-fixed-top">
    <div class="container">
        <div class="navbar-header">
-            <a class="navbar-brand" href="https://kkview.cn" target='_blank'>kkFileView</a>
+            <a class="navbar-brand" href="https://kkview.cn" target="_blank">kkFileView</a>
        </div>
        <ul class="nav navbar-nav">
            <li><a href="./index">首页</a></li>
            <li><a href="./integrated">接入说明</a></li>
            <li><a href="./record">版本发布记录</a></li>
            <li class="active"><a href="./sponsor">赞助开源</a></li>
+            <li><a href="./contact">技术支持</a></li>
        </ul>
    </div>
 </nav>

-<div class="container theme-showcase" role="main">
-    <#--  接入说明  -->
-    <div class="page-header">
-        <h1>赞助开源</h1>
-        <ul style="font-size: 16px;">
-            <li>kkFileView 开源至今已 6 个年头，积累 <a target="_blank" href="https://gitee.com/kekingcn/file-online-preview">Gitee(16.9K)</a>、<a target="_blank" href="https://github.com/kekingcn/kkFileView">GitHub(8k)</a> 多的 star</li>
-            <li>kkFileView 被广泛应用于金融、教育、银行、政务、计算机等行业, 不完全统计有 200+ 企业在使用</li>
-            <li>kkFileView 每年的文档站点、演示站点的服务器、CDN 资源, 至少在 1000元以上</li>
-            <li>kkFileView 是一款完全开源的在线预览项目，如果你觉得 kkFileView 对你有帮助，可以通过下面的方式来赞助我们，谢谢！</li>
-        </ul>
-    </div>
-    <div>
-        <div style="font-size: 16px; text-align: center;">
-            <img width="400px" height="550px" alt="alipay" src="../images/alipay.jpeg"/> &nbsp;&nbsp;&nbsp;<img width="400px" height="550px" alt="wxpay" src="../images/wxpay.jpeg"/>
+<div class="page-shell">
+    <div class="container" role="main">
+        <section class="hero-section release-hero">
+            <div class="hero-copy">
+                <span class="eyebrow">Sponsor Open Source</span>
+                <h1 class="hero-title">赞助开源</h1>
+                <p class="hero-subtitle">
+                    kkFileView 已持续维护多年，被广泛用于金融、教育、银行、政务和企业内部系统。
+                    赞助会直接用于文档站、演示站、服务器和 CDN 等基础开销。
+                </p>
+                <div class="summary-grid">
+                    <div class="summary-panel">
+                        <strong>多年维护</strong>
+                        <span>项目长期迭代，持续补格式、补安全、补性能。</span>
+                    </div>
+                    <div class="summary-panel">
+                        <strong>广泛使用</strong>
+                        <span>不完全统计已有 200+ 企业或团队在使用。</span>
+                    </div>
+                    <div class="summary-panel">
+                        <strong>基础成本</strong>
+                        <span>文档站、演示站和 CDN 等年成本至少在千元级。</span>
+                    </div>
+                </div>
+                <div class="note-row">
+                    <span class="tag brand"><a target="_blank" href="https://gitee.com/kekingcn/file-online-preview">Gitee</a></span>
+                    <span class="tag brand"><a target="_blank" href="https://github.com/kekingcn/kkFileView">GitHub</a></span>
+                    <span class="tag highlight">完全开源</span>
+                </div>
+            </div>
+        </section>
+
+        <div class="sponsor-grid">
+            <section class="doc-card">
+                <div class="doc-card-header">
+                    <div>
+                        <span class="eyebrow">Ways To Sponsor</span>
+                        <h3>赞助方式</h3>
+                    </div>
+                </div>
+                <p>如果你觉得 kkFileView 对你有帮助，可以通过下面的方式赞助项目，支持它继续长期维护。</p>
+                <ul>
+                    <li>kkFileView 开源至今已多年，社区持续反馈并推动演进。</li>
+                    <li>项目 star 与使用规模已经证明它不是“玩具 demo”，而是被真实系统接入的基础能力。</li>
+                    <li>赞助记录为手动录入，存在周级延迟；如有遗漏，可联系作者补录。</li>
+                </ul>
+
+                <div class="donation-wall">
+                    <div class="qr-card">
+                        <h4>支付宝</h4>
+                        <img alt="支付宝赞助码" src="../images/alipay.jpeg"/>
+                    </div>
+                    <div class="qr-card">
+                        <h4>微信支付</h4>
+                        <img alt="微信赞助码" src="../images/wxpay.jpeg"/>
+                    </div>
+                </div>
+            </section>
+
+            <section class="doc-card">
+                <div class="doc-card-header">
+                    <div>
+                        <span class="eyebrow">Sponsor Log</span>
+                        <h3>赞助记录</h3>
+                    </div>
+                    <div class="tags">
+                        <span class="tag">2023-03-14 开启赞助通道</span>
+                    </div>
+                </div>
+                <p>赞助记录为手动维护，如有遗漏，请联系作者补充。</p>
+                <table class="table sponsor-table">
+                    <thead>
+                    <tr>
+                        <th>赞助人</th>
+                        <th>赞助金额</th>
+                        <th>赞助时间</th>
+                        <th>备注</th>
+                    </tr>
+                    </thead>
+                    <tbody>
+                    <tr>
+                        <td>陈**</td>
+                        <td class="sponsor-amount">99</td>
+                        <td>2023-03-14</td>
+                        <td>首批赞助记录</td>
+                    </tr>
+                    </tbody>
+                </table>
+            </section>
        </div>
    </div>
-    <div>
-        <h3>赞助记录</h3>
-        2023-03-14 开启赞助通道，赞助记录为手动录入的，存在周级别延迟，如有遗漏，请联系作者补充
-        <br/>
-        <table class="table table-striped table-bordered">
-            <tr>
-                <th>赞助人</th>
-                <th>赞助金额</th>
-                <th>赞助时间</th>
-                <th>备注</th>
-            </tr>
-
-            <tr>
-                <td>陈**</td>
-                <td>99</td>
-                <td>2023-03-14</td>
-                <td></td>
-            </tr>
-
-        </table>
-    </div>
 </div>
-
 </body>
 </html>
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
kl	a199b4a7fe	fix: honor custom watermark settings in PDF preview	2026-08-25 08:39:11 +08:00
kl	c4288f7e59	Merge pull request #780 from kekingcn/release/5.0.2 Release v5.0.2	2026-08-14 14:33:28 +08:00
kl	e2bcb67d43	chore(release): prepare v5.0.2	2026-08-14 14:28:41 +08:00
kl	69b234fda2	Merge commit from fork Fix insecure default file deletion	2026-08-14 14:14:37 +08:00
kl	56eceebef8	Merge commit from fork Sandbox HTML preview execution	2026-08-14 14:12:17 +08:00
kl	f852bf844b	fix: secure demo file deletion	2026-08-14 11:12:50 +08:00
kl	583208898f	fix: sandbox HTML preview execution	2026-08-14 11:12:50 +08:00
kl	9c3fd82076	Merge pull request #779 from kekingcn/pdf-jbig2-image-loss fix: refresh ImageIO plugins before PDF conversion	2026-08-11 13:00:24 +08:00
kl	257180eb95	fix: refresh ImageIO plugins before PDF conversion	2026-08-11 12:54:50 +08:00
kl	e134689df3	Merge pull request #771 from kekingcn/release/5.0.1 Release v5.0.1	2026-07-13 17:16:27 +08:00
kl	3a08031929	chore(release): prepare v5.0.1	2026-07-13 17:12:40 +08:00
kl	47745e4d74	Merge commit from fork	2026-07-13 16:53:58 +08:00
kl	332a98b6fa	Add security policy (#770 )	2026-06-29 14:58:29 +08:00
Spencer.Chang	67c6ba3b13	Optimize LuckyExcel xlsx preview conversion with Web Worker (#766 ) * Optimize LuckyExcel conversion with worker * Fallback LuckyExcel worker errors to main thread	2026-06-29 11:20:50 +08:00
addwes7	3e16ed9d3b	Add Windows and macOS to CI build matrix and fix cross-platform issues (#768 ) * Add Windows and macOS to CI build matrix and fix cross-platform issues * run nightly e2e on ubuntu and prevent duplicate artifact upload	2026-06-26 11:38:15 +08:00
kl	32a887aa2c	fix: protect addTask with trust filters (#767 )	2026-06-24 14:19:20 +08:00
gaoxingzaq	1f60e30f09	优化：区分 HTTP 错误，返回明确原因 (#752 ) * 优化：区分 HTTP 错误，返回明确原因 * 修复缓存关闭共享的 client，会导致后续请求失败 * 修复缓存关闭共享的 client，会导致后续请求失败 --------- Co-authored-by: 高雄 <admin@cxcp.com>	2026-05-09 15:04:25 +08:00
Lanwood	4474ab1d57	fix(xlsx): 修复 LuckyExcel 解析数据校验时 matchType 未映射导致的崩溃 (#730 ) * fix(xlsx): 修复 LuckyExcel 解析数据校验时 matchType 未映射导致的崩溃 * fix(xlsx): improve matchType handling in data verification logic * fix(xlsx): simplify matchType mapping logic in LuckySheet class --------- Co-authored-by: 何武德 <hewude@ruijie.com.cn>	2026-05-09 15:03:26 +08:00
kl	fd78fe9a6e	test/docs: adjust PDF sidebar config test for conditional default (#756 )	2026-04-30 18:50:39 +08:00
kl	cdce432740	feat: make pdf sidebar default open configurable (#755 )	2026-04-30 18:36:40 +08:00
陈精华	4ea1d7468a	Merge pull request #746 from gaoxingzaq/pdfjs2 pdf 添加跨域功能修复pdf 页码和高亮没启用bug	2026-04-29 14:22:00 +08:00
高雄	4cf19d1dbe	优化结构去掉JQ脚本内置水印脚本	2026-04-25 08:45:22 +08:00
高雄	3abf864184	修复 pdf无法打印问题修复pdf打印添加水印问题	2026-04-24 16:42:19 +08:00
陈精华	634babfba4	Merge pull request #751 from gaoxingzaq/redis22 修复redis报错	2026-04-21 19:06:55 +08:00
高雄	e7fe1afe19	修复：1、redis报错、统一了所有模式（单机、集群、主从、哨兵）的配置参数：都设置了 retryAttempts, retryInterval, timeout, connectTimeout, idleConnectionTimeout, 连接池大小等。3、地址自动补齐协议前缀：normalizeAddress() 方法自动添加 redis://，用户配置可以省略，其他等等。	2026-04-21 14:08:16 +08:00
高雄	cd2abb4be1	修复反代后绝对路径错误	2026-04-17 17:37:03 +08:00
高雄	dd803126dd	修复反代后绝对路径错误	2026-04-16 17:32:09 +08:00
高雄	633e47b765	修复反代后绝对路径错误	2026-04-16 17:26:41 +08:00
高雄	c52d80c123	修复水印和高亮特殊符号会导致解析失败问题	2026-04-16 11:21:59 +08:00
高雄	ee2a27501b	pdf 添加跨域功能修复pdf 页码和高亮没启用bug	2026-04-15 14:40:41 +08:00
kl	171762d676	Merge pull request #740 from kekingcn/release/5.0.0 Release 5.0.0	2026-04-14 09:13:51 +08:00
kl	76e091900b	Complete 5.0.0 release notes from v4.4.0 diff	2026-04-14 09:07:18 +08:00
kl	bfa4ceab90	Document 5.0.0 default config changes	2026-04-14 09:04:43 +08:00
kl	b18cfa797a	Align release record page with 5.0.0	2026-04-14 09:02:29 +08:00
kl	8a117a41e8	Merge v5.0 notes into 5.0.0 release notes	2026-04-14 09:00:11 +08:00
kl	17ba41320e	Prepare 5.0.0 release	2026-04-14 08:57:01 +08:00
kl	476c0bfefc	Merge pull request #739 from kekingcn/paseo/ai-docs Add AI-friendly repository guide	2026-04-14 08:13:52 +08:00
kl	1c6691d785	Clarify config defaults in AGENTS guide	2026-04-14 08:06:52 +08:00
kl	36ae290cb6	Add AI-friendly repository guide	2026-04-14 07:54:42 +08:00
kl	597715ce33	Merge pull request #738 from kekingcn/paseo/kkfileview Refine archive preview and PDF defaults	2026-04-13 21:09:42 +08:00
kl	a8a08c1dcc	Address PR review feedback	2026-04-13 21:02:59 +08:00
kl	7757729efd	Refine archive preview and PDF defaults	2026-04-13 20:54:27 +08:00
kl	b246bfdac7	Merge pull request #737 from kekingcn/codex/fix-index-form-layout fix: correct index preview form layout	2026-04-11 21:36:37 +08:00
chenkailing	d35393ba22	fix: tighten index form layout	2026-04-11 21:30:25 +08:00
chenkailing	c893dd7095	fix: keep preview parameters on one row	2026-04-11 21:12:06 +08:00
kl	9bdb18d833	Merge pull request #736 from kekingcn/codex/ci-auto-deploy-server-build feat: add server-build auto deploy	2026-04-11 20:30:13 +08:00
chenkailing	58fc1af74f	fix: address deploy review comments	2026-04-11 20:22:15 +08:00
chenkailing	1b3cf33bf0	feat: add server-build auto deploy	2026-04-11 19:36:19 +08:00
kl	c9005d0c04	Merge pull request #735 from kekingcn/codex/ci-auto-deploy-fix fix: harden master auto deploy artifact delivery	2026-04-11 17:16:26 +08:00
chenkailing	37bda20d08	fix: harden master auto deploy artifact delivery	2026-04-11 17:08:31 +08:00
kl	1819861647	Merge pull request #734 from kekingcn/codex/ci-auto-deploy [codex] add master auto deploy workflow	2026-04-11 16:27:37 +08:00
chenkailing	352b86b40d	fix: address deploy review feedback	2026-04-11 16:14:01 +08:00
chenkailing	853ad0154f	chore: drop generated pycache	2026-04-11 15:54:43 +08:00
chenkailing	c88bf04a0d	feat: add master auto deploy workflow	2026-04-11 15:54:11 +08:00
kl	6a84e61ecb	Merge pull request #733 from kekingcn/codex/redesign-demo-page-v1-polish [codex] polish demo portal pages	2026-04-11 15:29:47 +08:00
chenkailing	dd6e369e6a	feat: polish demo portal pages	2026-04-11 15:19:26 +08:00
chenkailing	bd20546b6d	feat: redesign demo pages v1	2026-04-11 00:29:49 +08:00
				`@@ -0,0 +1 @@`
				<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Microsoft Excel</title><path d="M23 1.5q.41 0 .7.3.3.29.3.7v19q0 .41-.3.7-.29.3-.7.3H7q-.41 0-.7-.3-.3-.29-.3-.7V18H1q-.41 0-.7-.3-.3-.29-.3-.7V7q0-.41.3-.7Q.58 6 1 6h5V2.5q0-.41.3-.7.29-.3.7-.3zM6 13.28l1.42 2.66h2.14l-2.38-3.87 2.34-3.8H7.46l-1.3 2.4-.05.08-.04.09-.64-1.28-.66-1.29H2.59l2.27 3.82-2.48 3.85h2.16zM14.25 21v-3H7.5v3zm0-4.5v-3.75H12v3.75zm0-5.25V7.5H12v3.75zm0-5.25V3H7.5v3zm8.25 15v-3h-6.75v3zm0-4.5v-3.75h-6.75v3.75zm0-5.25V7.5h-6.75v3.75zm0-5.25V3h-6.75v3Z"/></svg>