0 Fork 0

T

weidu12123andClaude Fable 5 14e7066db9 fix: close pre-release security holes and correctness bugs

- 静态资源回退存在路径穿越，未鉴权即可读出 secret.key 与 vps-switch.db
- MCP 端点默认要求 API Key；删除可被客户端伪造的 x-vps-switch-stdio 豁免头
- 跨源只放行本机回环来源；绑回环时校验 Host，挡 DNS rebinding
- 本机命令输出中文乱码（本机与远端共用 EncodedCommand + UTF-8）
- 远端拿不到退出码时不再报成功；cross 传输超时不再谎报"后台传输中"
- 任务表与单流输出加上限；传输队列双锁死锁改单锁；回收已退出的终端 pane
- 前端终端创建改为按主机去重；终端断线自动重连并给出提示

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-10-13 22:12:39 +08:00

.cargo

feat: initial commit of vps-switch core modules and desktop frontend

2026-10-13 16:36:22 +08:00

docs

feat: adopt monochrome topological lock brand icon (Option D)

2026-10-13 18:08:02 +08:00

frontend

fix: close pre-release security holes and correctness bugs

2026-10-13 22:12:39 +08:00

src

fix: close pre-release security holes and correctness bugs