Affected by GO-2026-4414 and 1 other vulnerabilities

GO-2026-4414: Alist has Insecure TLS Config in github.com/alist-org/alist

GO-2026-4415: Alist vulnerable to Path Traversal in multiple file operation handlers in github.com/alist-org/alist

common

package

v3.46.0 Latest Latest Go to latest Published: Jul 26, 2025 License: AGPL-3.0 Imports: 27 Imported by: 12

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/alist-org/alist

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
Variables
func CanAccess(user *model.User, meta *model.Meta, reqPath string, password string) bool
func CanAccessWithRoles(u *model.User, meta *model.Meta, reqPath, password string) bool
func CanWrite(meta *model.Meta, path string) bool
func CheckPathLimitWithRoles(u *model.User, reqPath string) bool
func ErrorResp(c *gin.Context, err error, code int, l ...bool)
func ErrorStrResp(c *gin.Context, str string, code int, l ...bool)
func ErrorWithDataResp(c *gin.Context, err error, code int, data interface{}, l ...bool)
func GenerateToken(user *model.User) (tokenString string, err error)
func GetApiUrl(r *http.Request) string
func GetEtag(file model.Obj) string
func GetHttpReq(ctx context.Context) *http.Request
func HasPermission(perm int32, bit uint) bool
func InvalidateToken(tokenString string) error
func IsApply(metaPath, reqPath string, applySub bool) bool
func IsStorageSignEnabled(rawPath string) bool
func IsTokenInvalidated(tokenString string) bool
func MergeRolePermissions(u *model.User, reqPath string) int32
func Pluralize(count int, singular, plural string) string
func Proxy(w http.ResponseWriter, r *http.Request, link *model.Link, file model.Obj) error
func ProxyRange(link *model.Link, size int64)
func ShouldProxy(storage driver.Driver, filename string) bool
func Sign(obj model.Obj, parent string, encrypt bool) string
func SuccessResp(c *gin.Context, data ...interface{})
func SuccessWithMsgResp(c *gin.Context, msg string, data ...interface{})
type InterceptResponseWriter
- func (iw *InterceptResponseWriter) Write(p []byte) (int, error)
type PageResp
type Resp
type UserClaims
- func ParseToken(tokenString string) (*UserClaims, error)
type WrittenResponseWriter
- func (ww *WrittenResponseWriter) IsWritten() bool
- func (ww *WrittenResponseWriter) Write(p []byte) (int, error)

Constants ¶

View Source

const (
	PermSeeHides = iota
	PermAccessWithoutPassword
	PermAddOfflineDownload
	PermWrite
	PermRename
	PermMove
	PermCopy
	PermRemove
	PermWebdavRead
	PermWebdavManage
	PermFTPAccess
	PermFTPManage
	PermReadArchives
	PermDecompress
	PermPathLimit
)

Variables ¶

View Source

var NoProxyRange = &model.RangeReadCloser{}

View Source

var SecretKey []byte

Functions ¶

func CanAccess ¶ added in v3.5.1

func CanAccess(user *model.User, meta *model.Meta, reqPath string, password string) bool

func CanAccessWithRoles ¶ added in v3.46.0

func CanAccessWithRoles(u *model.User, meta *model.Meta, reqPath, password string) bool

func CanWrite ¶ added in v3.5.1

func CanWrite(meta *model.Meta, path string) bool

func CheckPathLimitWithRoles ¶ added in v3.46.0

func CheckPathLimitWithRoles(u *model.User, reqPath string) bool

CheckPathLimitWithRoles checks whether the path is allowed when the user has the `PermPathLimit` permission for the target path. When the user does not have this permission, the check passes by default.

func ErrorResp ¶

func ErrorResp(c *gin.Context, err error, code int, l ...bool)

ErrorResp is used to return error response @param l: if true, log error

func ErrorStrResp ¶

func ErrorStrResp(c *gin.Context, str string, code int, l ...bool)

func ErrorWithDataResp ¶ added in v3.5.1

func ErrorWithDataResp(c *gin.Context, err error, code int, data interface{}, l ...bool)

func GenerateToken ¶

func GenerateToken(user *model.User) (tokenString string, err error)

func GetApiUrl ¶

func GetApiUrl(r *http.Request) string

func GetEtag ¶ added in v3.43.0

func GetEtag(file model.Obj) string

func GetHttpReq ¶ added in v3.42.0

func GetHttpReq(ctx context.Context) *http.Request

func HasPermission ¶ added in v3.46.0

func HasPermission(perm int32, bit uint) bool

func InvalidateToken ¶ added in v3.37.0

func InvalidateToken(tokenString string) error

func IsApply ¶ added in v3.13.0

func IsApply(metaPath, reqPath string, applySub bool) bool

func IsStorageSignEnabled ¶ added in v3.15.0

func IsStorageSignEnabled(rawPath string) bool

func IsTokenInvalidated ¶ added in v3.37.0

func IsTokenInvalidated(tokenString string) bool

func MergeRolePermissions ¶ added in v3.46.0

func MergeRolePermissions(u *model.User, reqPath string) int32

func Pluralize ¶ added in v3.43.0

func Pluralize(count int, singular, plural string) string

func Proxy ¶

func Proxy(w http.ResponseWriter, r *http.Request, link *model.Link, file model.Obj) error

func ProxyRange ¶ added in v3.35.0

func ProxyRange(link *model.Link, size int64)

func ShouldProxy ¶ added in v3.14.0

func ShouldProxy(storage driver.Driver, filename string) bool

ShouldProxy TODO need optimize when should be proxy? 1. config.MustProxy() 2. storage.WebProxy 3. proxy_types

func Sign ¶

func Sign(obj model.Obj, parent string, encrypt bool) string

func SuccessResp ¶

func SuccessResp(c *gin.Context, data ...interface{})

func SuccessWithMsgResp ¶ added in v3.43.0

func SuccessWithMsgResp(c *gin.Context, msg string, data ...interface{})

Types ¶

type InterceptResponseWriter ¶ added in v3.45.0

type InterceptResponseWriter struct {
	http.ResponseWriter
	io.Writer
}

func (*InterceptResponseWriter) Write ¶ added in v3.45.0

func (iw *InterceptResponseWriter) Write(p []byte) (int, error)

type PageResp ¶

type PageResp struct {
	Content interface{} `json:"content"`
	Total   int64       `json:"total"`
}

type Resp ¶

type Resp[T any] struct {
	Code    int    `json:"code"`
	Message string `json:"message"`
	Data    T      `json:"data"`
}

type UserClaims ¶

type UserClaims struct {
	Username string `json:"username"`
	PwdTS    int64  `json:"pwd_ts"`
	jwt.RegisteredClaims
}

func ParseToken ¶

func ParseToken(tokenString string) (*UserClaims, error)

type WrittenResponseWriter ¶ added in v3.45.0

type WrittenResponseWriter struct {
	http.ResponseWriter
	// contains filtered or unexported fields
}

func (*WrittenResponseWriter) IsWritten ¶ added in v3.45.0

func (ww *WrittenResponseWriter) IsWritten() bool

func (*WrittenResponseWriter) Write ¶ added in v3.45.0

func (ww *WrittenResponseWriter) Write(p []byte) (int, error)

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL