Jian Qiu 95332ed656 fix(webconsole): authenticate sftp endpoints and check session owner (#25502) ...

The sftp list/download/upload endpoints were not protected by
authentication, only by the UUID4 session id. Anyone who learned the
session id (it appears in URLs and logs) could list, download and
upload files of the VM over the victim's active SSH/SFTP channel.

Wrap all three endpoints with auth.Authenticate and record the owner
of each sftp session at registration, so only the user who opened the
session can use it.

Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
Co-authored-by: Claude <noreply@anthropic.com>

2026-09-04 13:46:08 +08:00

..

doc.go

…

rdp_server.go

fix(webconsole): rdp 用户隔离上传文件 (#18920)

2023-12-07 15:22:10 +08:00

server.go

fix(region): vendor update (#25196)

2026-07-21 23:31:44 +08:00

sftp_auth.go

fix(webconsole): authenticate sftp endpoints and check session owner (#25502)

2026-09-04 13:46:08 +08:00

sftp_server.go

fix(webconsole): authenticate sftp endpoints and check session owner (#25502)

2026-09-04 13:46:08 +08:00

ssh_server.go

fix(webconsole): authenticate sftp endpoints and check session owner (#25502)

2026-09-04 13:46:08 +08:00

tty_server.go

fix(webconsole,apigateway): execute container command by climc ssh way (#21812)

2024-12-16 18:49:42 +08:00

websocketproxy_server.go

fix(region): vendor update (#25196)

2026-07-21 23:31:44 +08:00

websockify_server.go

fix: ipv6-only mode compatibility fixes (#23027)

2025-08-06 22:01:55 +08:00