H1K0 3b79f12ec0 fix(backend): bound image decode and ffmpeg during thumbnailing ...

Thumbnail/preview generation decoded untrusted images with no size limit
(a decompression bomb could exhaust memory) and ran ffmpeg with no
timeout (a malformed video could hang the request). Image dimensions are
now checked via image.DecodeConfig before the raster is allocated and
rejected above 64 Mpx, and ffmpeg runs under a 30s timeout.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-10 14:11:31 +03:00

backend

fix(backend): bound image decode and ffmpeg during thumbnailing

2026-06-10 14:11:31 +03:00

docs

docs(project): add reference Python/Flask implementation

2026-04-03 18:36:05 +03:00

frontend

fix(frontend): use $appSettings.tagRuleApplyToExisting on creating a new tag rule also

2026-04-07 11:59:09 +03:00

.env.example

fix(backend): cap upload size to prevent memory exhaustion

2026-06-10 14:07:34 +03:00

.gitattributes

chore(project): add .gitignore and .gitattributes

2026-04-03 18:35:22 +03:00

.gitignore

chore(project): add .gitignore and .gitattributes

2026-04-03 18:35:22 +03:00

CLAUDE.md

docs(project): document scoped commit naming convention in CLAUDE.md

2026-04-04 21:41:22 +03:00

openapi.yaml

feat(backend): apply tag rules retroactively to existing files on activation

2026-04-07 00:00:45 +03:00

S

Description

🎋Tanabata — web file manager with tags!

apicfile-managergolangpythonrestapitelegram-botwebapp

5.6 MiB

Languages

Go 50%

Svelte 38.6%

TypeScript 8.8%

PLpgSQL 1.4%

Dockerfile 0.5%

Other 0.7%