Commit Graph

25 Commits (10a955fd6241f82424cefc2cf3c25a13021f5af6)

Author SHA1 Message Date
boojack 10a955fd62 refactor: move plugin packages under internal 2 months ago
boojack 4b4e719470
feat(attachments): add Live Photo and Motion Photo support (#5810) 2 months ago
memoclaw 4add9b04ad fix: prevent local attachment uploads from overwriting files 3 months ago
memoclaw 8f43e8075b
fix: correct typos in comments, error messages, and identifiers (#5704)
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
3 months ago
memoclaw 92d937b1aa
feat: replace auto-increment ID with UID for identity provider resource names (#5687)
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
3 months ago
Johnny c7b48b800f fix: add access control checks for attachments, comments, and reactions
Security fixes for multiple authorization bypass vulnerabilities:

- GetAttachment: Add visibility check via checkAttachmentAccess helper
- UpdateAttachment: Add ownership check (creator or admin only)
- Fileserver: Require creator/admin auth for unlinked attachments
- ListMemoAttachments: Add memo visibility check
- CreateMemoComment: Add memo visibility check for target memo
- ListMemoReactions: Add memo visibility check
- UpsertMemoReaction: Add memo visibility check

All checks follow the existing pattern used in GetMemo for consistency.
5 months ago
Johnny a7b0d71f6e feat: implement EXIF metadata stripping for image uploads 5 months ago
Steven e1941e7843 fix: attachment type checks 5 months ago
Johnny f66c750075 chore: simplify attachment file writing 6 months ago
Johnny 78aa41336a feat: implement attachment filtering functionality 6 months ago
Johnny 7932f6d0d0
refactor: user auth improvements (#5360) 6 months ago
Johnny ea14280cb3 feat: enhance attachment handling with MIME type validation 6 months ago
xiaolinny 6beb3fcde0
chore: fix some typos in comments (#5332)
Signed-off-by: xiaolinny <xiaolincode@outlook.com>
6 months ago
Steven 1cf047707b refactor: migrate binary file serving from gRPC to dedicated HTTP fileserver
Migrates attachment and avatar binary serving from gRPC endpoints to a new dedicated HTTP fileserver package, fixing Safari video playback issues and improving architectural separation.

Key changes:
- Created server/router/fileserver package for all binary file serving
- Removed GetAttachmentBinary and GetUserAvatar gRPC endpoints from proto
- Implemented native HTTP handlers with full range request support
- Added authentication support (session cookies + JWT) to fileserver
- New avatar endpoint supports lookup by user ID or username
- Eliminated duplicate auth constants (imports from api/v1)

HTTP endpoints:
- Attachments: /file/attachments/:uid/:filename (unchanged URL)
- Avatars: /file/users/:identifier/avatar (new URL format)

This fixes Safari video/audio playback by using http.ServeContent() which properly handles HTTP 206 Partial Content responses and range request headers.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
6 months ago
Steven 8f29db2f49 fix(server): prevent memory exhaustion in thumbnail generation
Address high memory usage when opening resource tab (fixes #5183) by implementing:

1. Concurrency control: Limit thumbnail generation to 3 concurrent operations using semaphore to prevent memory exhaustion when many images are requested simultaneously

2. S3 optimization: Skip server-side thumbnail generation for S3-stored images by default. S3 images now use presigned URLs directly, avoiding:
   - Downloading large images from S3 into server memory
   - Decoding and resizing images on the server
   - High memory consumption during batch requests

3. Memory management improvements:
   - Explicitly clear blob and decoded image from memory after use
   - Restructure thumbnail cache check to avoid unnecessary semaphore acquisition
   - Double-check pattern to prevent duplicate generation while waiting

This restores the original S3 behavior before commit e4f6345 while maintaining thumbnail support for local/database storage.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
7 months ago
Steven 4c1d1c70d1 refactor: rename workspace to instance throughout codebase
Remove work-related terminology by renaming "workspace" to "instance"
across the entire application. This change better reflects that Memos
is a self-hosted tool suitable for personal and non-work use cases.

Breaking Changes:
- API endpoints: /api/v1/workspace/* → /api/v1/instance/*
- gRPC service: WorkspaceService → InstanceService
- Proto types: WorkspaceSetting → InstanceSetting
- Frontend translation keys: workspace-section → instance-section

Backend Changes:
- Renamed proto definitions and regenerated code
- Updated all store layer methods and database drivers
- Renamed service implementations and API handlers
- Updated cache from workspaceSettingCache to instanceSettingCache

Frontend Changes:
- Renamed service client: workspaceServiceClient → instanceServiceClient
- Updated all React components and state management
- Refactored stores: workspace.ts → instance.ts
- Updated all 32 locale translation files

All tests pass and both backend and frontend build successfully.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
7 months ago
Florian Dewald 5f57f48673
fix(security): validate attachment filenames (#5218) 7 months ago
Florian Dewald e4f6345342
feat: generate thumbnails for images stored in S3 and generate thumbnails with a maximum size (#5179) 8 months ago
Steven c09ea5a8ab chore: remove basic filter support from ListAttachments method 8 months ago
Johnny efe6013c36 fix: add user authentication checks 8 months ago
Johnny 7cc2df9254 chore: fix linter 10 months ago
varsnotwars 4eb5b67baf
feat: attachments by id (#5008) 10 months ago
Johnny 52a5ca2ef4 chore: update get attachment binary 12 months ago
Steven a4920d464b refactor: attachment service part2 1 year ago
Steven bb5809cae4 refactor: attachment service 1 year ago