Chris LuandGitHub 02b3ec6e90 sftp: url-encode the upload path (#10758) ...

sftp: url-encode the upload path so filenames can't inject filer query commands

The SFTP put handler concatenated the user-controlled filename straight into
the filer upload URL, so a name containing "?" was parsed as a query string.
Build the URL via url.URL{Path: ...} so "?" becomes %3F and stays a literal
path character.

2026-08-14 09:19:37 -07:00

..

admin

plugin scheduler: drain started jobs past the window close instead of killing them (#10728)

2026-08-12 19:38:22 -07:00

cluster

filer: rebuild peer metadata subscriptions after a master reconnect (#10648)

2026-08-08 10:28:25 -07:00

command

redis2: orphan cleanup existence checks must not read replicas (#10745)

2026-08-13 13:33:15 -07:00

credential

s3: apply filer identity changes despite a static config file (#10392)

2026-07-27 14:06:04 -07:00

filer

ci: run the gated redis store tests (#10746)

2026-08-13 13:36:31 -07:00

filer_client

…

glog

…

iam

s3api: load document-style policies from the advanced IAM config (#10481)

2026-07-29 10:30:30 -07:00

iamapi

iam: authorize IAM management actions as IAM actions (#10593)

2026-08-05 17:08:21 -07:00

images

Add codespell support with configuration and typo fixes (#10393)

2026-07-22 14:38:06 -07:00

kms

kms: cache decrypted data keys so cache_enabled/cache_ttl take effect (#10173)

2026-06-30 21:23:53 -07:00

mount

mount: invalidate hot directory listings by section (#10712)

2026-08-11 21:11:18 -07:00

mq

mount: version open file handles by filer log position (#10403)

2026-07-23 17:44:02 -07:00

notification

security: add BearerPrefix constant for Authorization headers (#10101)

2026-06-24 19:36:42 -07:00

operation

EC: handle zero-sized shard files uniformly (moves, rebuilds, startup cleanup) (#10753)

2026-08-13 21:38:22 -07:00

pb

feat: throughput limits for replicate, EC shard, and worker-driven moves (#10749)

2026-08-13 13:22:58 -07:00

placement

placement: let callers reject candidates placement cannot judge (#10581)

2026-08-05 00:18:22 -07:00

plugin/worker

clients: stream the volume listings that ask for everything (#10679)

2026-08-10 09:51:08 -07:00

query

s3: invalidate stale reader cache locations on chunk read failure (#10156)

2026-06-30 13:27:49 -07:00

remote_storage

volume: extend the remote-endpoint guard to the azure backend (#10754)

2026-08-13 22:32:59 -07:00

replication

volume: extend the remote-endpoint guard to the azure backend (#10754)

2026-08-13 22:32:59 -07:00

s3api

read cold remote objects straight from the origin while caching (#10731)

2026-08-12 23:00:10 -07:00

security

grpc: optional client_cert/client_key for outgoing mTLS connections (#10747)

2026-08-13 13:15:20 -07:00

sequence

…

server

volume: validate replica targets and restrict gcs credentials in FetchAndWriteNeedle (#10755)

2026-08-13 23:33:01 -07:00

sftpd

sftp: url-encode the upload path (#10758)

2026-08-14 09:19:37 -07:00

shell

feat(shell): parallelize volume balance moves (#10737)

2026-08-13 19:11:38 -07:00

static

…

stats

filer: retry and surface metadata replay failures from peers (#10714)

2026-08-11 12:36:22 -07:00

storage

EC: handle zero-sized shard files uniformly (moves, rebuilds, startup cleanup) (#10753)

2026-08-13 21:38:22 -07:00

telemetry

telemetry: count erasure-coded volumes in the reported totals (#10632)

2026-08-07 17:08:15 -07:00

topology

storage: count a volume's needles in uint32 (#10718)

2026-08-11 16:36:36 -07:00

util

skiplist: fix TestFindGreaterOrEqual flake (compare against largest key, not value) (#10757)

2026-08-14 08:31:31 -07:00

wdclient

wdclient: keep the location of a volume reported added and removed at once (#10635)

2026-08-07 19:44:49 -07:00

worker

feat: throughput limits for replicate, EC shard, and worker-driven moves (#10749)

2026-08-13 13:22:58 -07:00

Makefile

…

weed.go

…