diff --git a/.github/workflows/release-on-version.yml b/.github/workflows/release-on-version.yml index 5450ccd..dd963d2 100644 --- a/.github/workflows/release-on-version.yml +++ b/.github/workflows/release-on-version.yml @@ -1,110 +1,153 @@ --- -name: Release on version.js update - -on: - push: - branches: - - master - paths: - - public/js/version.js - workflow_run: - workflows: "Bump version and sync Changelog to Docker Repo" - types: completed - -permissions: - contents: write - -jobs: - release: - runs-on: ubuntu-latest - concurrency: - group: release-${{ github.ref }}-${{ github.sha }} - cancel-in-progress: false - - steps: - - name: Checkout - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - name: Read version from version.js - id: ver - shell: bash - run: | - set -euo pipefail - VER=$(grep -Eo "APP_VERSION\s*=\s*['\"]v[^'\"]+['\"]" public/js/version.js | sed -E "s/.*['\"](v[^'\"]+)['\"].*/\1/") - if [[ -z "$VER" ]]; then - echo "Could not parse APP_VERSION from version.js" >&2 - exit 1 - fi - echo "version=$VER" >> "$GITHUB_OUTPUT" - echo "Parsed version: $VER" - - - name: Skip if tag already exists - id: tagcheck - shell: bash - run: | - set -euo pipefail - git fetch --tags --quiet - if git rev-parse -q --verify "refs/tags/${{ steps.ver.outputs.version }}" >/dev/null; then - echo "exists=true" >> "$GITHUB_OUTPUT" - echo "Tag ${{ steps.ver.outputs.version }} already exists. Skipping release." - else - echo "exists=false" >> "$GITHUB_OUTPUT" - fi - - - name: Prepare release notes from CHANGELOG.md (optional) - if: steps.tagcheck.outputs.exists == 'false' - id: notes - shell: bash - run: | - set -euo pipefail - NOTES_PATH="" - if [[ -f CHANGELOG.md ]]; then - awk ' - BEGIN{found=0} - /^## / && !found {found=1} - found && /^---$/ {exit} - found {print} - ' CHANGELOG.md > RELEASE_BODY.md || true - - # Trim trailing blank lines - sed -i -e :a -e '/^\n*$/{$d;N;ba' -e '}' RELEASE_BODY.md || true - - if [[ -s RELEASE_BODY.md ]]; then - NOTES_PATH="RELEASE_BODY.md" + name: Release on version.js update + + on: + push: + branches: + - master + paths: + - public/js/version.js + workflow_run: + workflows: "Bump version and sync Changelog to Docker Repo" + types: completed + + permissions: + contents: write + + jobs: + release: + runs-on: ubuntu-latest + concurrency: + group: release-${{ github.ref }}-${{ github.sha }} + cancel-in-progress: false + + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Read version from version.js + id: ver + shell: bash + run: | + set -euo pipefail + VER=$(grep -Eo "APP_VERSION\s*=\s*['\"]v[^'\"]+['\"]" public/js/version.js | sed -E "s/.*['\"](v[^'\"]+)['\"].*/\1/") + if [[ -z "$VER" ]]; then + echo "Could not parse APP_VERSION from version.js" >&2 + exit 1 fi - fi - echo "path=$NOTES_PATH" >> "$GITHUB_OUTPUT" - - - name: (optional) Build archive to attach - if: steps.tagcheck.outputs.exists == 'false' - shell: bash - run: | - set -euo pipefail - zip -r "FileRise-${{ steps.ver.outputs.version }}.zip" public/ README.md LICENSE >/dev/null || true - - # Path A: we have extracted notes -> use body_path - - name: Create GitHub Release (with CHANGELOG snippet) - if: steps.tagcheck.outputs.exists == 'false' && steps.notes.outputs.path != '' - uses: softprops/action-gh-release@v2 - with: - tag_name: ${{ steps.ver.outputs.version }} - target_commitish: ${{ github.sha }} - name: ${{ steps.ver.outputs.version }} - body_path: ${{ steps.notes.outputs.path }} - generate_release_notes: false - files: | - FileRise-${{ steps.ver.outputs.version }}.zip - - # Path B: no notes -> let GitHub auto-generate from commits - - name: Create GitHub Release (auto notes) - if: steps.tagcheck.outputs.exists == 'false' && steps.notes.outputs.path == '' - uses: softprops/action-gh-release@v2 - with: - tag_name: ${{ steps.ver.outputs.version }} - target_commitish: ${{ github.sha }} - name: ${{ steps.ver.outputs.version }} - generate_release_notes: true - files: | - FileRise-${{ steps.ver.outputs.version }}.zip + echo "version=$VER" >> "$GITHUB_OUTPUT" + echo "Parsed version: $VER" + + - name: Skip if tag already exists + id: tagcheck + shell: bash + run: | + set -euo pipefail + git fetch --tags --quiet + if git rev-parse -q --verify "refs/tags/${{ steps.ver.outputs.version }}" >/dev/null; then + echo "exists=true" >> "$GITHUB_OUTPUT" + echo "Tag ${{ steps.ver.outputs.version }} already exists. Skipping release." + else + echo "exists=false" >> "$GITHUB_OUTPUT" + fi + + # Build the artifact first so we can checksum it + - name: Build zip artifact + if: steps.tagcheck.outputs.exists == 'false' + shell: bash + run: | + set -euo pipefail + zip -r "FileRise-${{ steps.ver.outputs.version }}.zip" public/ README.md LICENSE >/dev/null || true + + - name: Compute SHA-256 checksum + if: steps.tagcheck.outputs.exists == 'false' + id: sum + shell: bash + run: | + set -euo pipefail + ZIP="FileRise-${{ steps.ver.outputs.version }}.zip" + SHA=$(shasum -a 256 "$ZIP" | awk '{print $1}') + echo "$SHA $ZIP" > "${ZIP}.sha256" + echo "sha=$SHA" >> "$GITHUB_OUTPUT" + echo "Computed SHA-256: $SHA" + + - name: Extract notes from CHANGELOG (optional) + if: steps.tagcheck.outputs.exists == 'false' + id: notes + shell: bash + run: | + set -euo pipefail + NOTES_PATH="" + if [[ -f CHANGELOG.md ]]; then + awk ' + BEGIN{found=0} + /^## / && !found {found=1} + found && /^---$/ {exit} + found {print} + ' CHANGELOG.md > CHANGELOG_SNIPPET.md || true + sed -i -e :a -e '/^\n*$/{$d;N;ba' -e '}' CHANGELOG_SNIPPET.md || true + if [[ -s CHANGELOG_SNIPPET.md ]]; then + NOTES_PATH="CHANGELOG_SNIPPET.md" + fi + fi + echo "path=$NOTES_PATH" >> "$GITHUB_OUTPUT" + + - name: Compute previous tag (for Full Changelog link) + if: steps.tagcheck.outputs.exists == 'false' + id: prev + shell: bash + run: | + set -euo pipefail + git fetch --tags --quiet + PREV=$(git tag --list "v*" --sort=-v:refname | sed -n '2p' || true) + if [[ -z "$PREV" ]]; then + PREV=$(git rev-list --max-parents=0 HEAD | tail -n1) + fi + echo "prev=$PREV" >> "$GITHUB_OUTPUT" + echo "Previous tag or baseline: $PREV" + + - name: Build release body (snippet + full changelog + checksum) + if: steps.tagcheck.outputs.exists == 'false' + shell: bash + run: | + set -euo pipefail + VER="${{ steps.ver.outputs.version }}" + PREV="${{ steps.prev.outputs.prev }}" + REPO="${GITHUB_REPOSITORY}" + COMPARE_URL="https://github.com/${REPO}/compare/${PREV}...${VER}" + ZIP="FileRise-${VER}.zip" + SHA="${{ steps.sum.outputs.sha }}" + + { + echo "## ${VER}" + echo + if [[ -s CHANGELOG_SNIPPET.md ]]; then + cat CHANGELOG_SNIPPET.md + echo + fi + echo "### Full Changelog" + echo "[${PREV} → ${VER}](${COMPARE_URL})" + echo + echo "### SHA-256 (zip)" + echo '```' + echo "${SHA} ${ZIP}" + echo '```' + } > RELEASE_BODY.md + + echo "Release body:" + sed -n '1,200p' RELEASE_BODY.md + + - name: Create GitHub Release + if: steps.tagcheck.outputs.exists == 'false' + uses: softprops/action-gh-release@v2 + with: + tag_name: ${{ steps.ver.outputs.version }} + target_commitish: ${{ github.sha }} + name: ${{ steps.ver.outputs.version }} + body_path: RELEASE_BODY.md + generate_release_notes: false + files: | + FileRise-${{ steps.ver.outputs.version }}.zip + FileRise-${{ steps.ver.outputs.version }}.zip.sha256 diff --git a/.github/workflows/sync-changelog.yml b/.github/workflows/sync-changelog.yml index ece7a26..e7e5375 100644 --- a/.github/workflows/sync-changelog.yml +++ b/.github/workflows/sync-changelog.yml @@ -52,7 +52,7 @@ jobs: echo "Stamping ?v=${QVER} and {{APP_VER}}=${VER}" # 1) Only stamp ?v= in HTML/CSS (avoid JS concatenation issues) - mapfile -t html_css < <(git ls-files -- 'public/*.html' 'public/**/*.html' 'public/*.css' 'public/**/*.css') + mapfile -t html_css < <(git ls-files -- 'public/*.html' 'public/**/*.html' 'public/*.php' 'public/**/*.css') for f in "${html_css[@]}"; do sed -E -i "s/(\?v=)[^\"'&<>\s]*/\1${QVER}/g" "$f" sed -E -i "s/\{\{APP_VER\}\}/${VER}/g" "$f" diff --git a/CHANGELOG.md b/CHANGELOG.md index 756568f..2adf282 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,20 @@ # Changelog +## Changes 10/28/2025 (v1.6.10) + +release(v1.6.10): self-host ReDoc, gate sidebar toggle on auth, and enrich release workflow + +- Vendor ReDoc and add MIT license file under public/vendor/redoc/; switch api.php to local bundle to satisfy CSP (script-src 'self'). +- main.js: add/remove body.authenticated on login/logout so UI can reflect auth state. +- dragAndDrop.js: only render sidebarToggleFloating when authenticated; stop event bubbling, keep dark-mode styles. +- sync-changelog.yml: also stamp ?v= in PHP templates (public/**/*.php). +- release-on-version.yml: build zip first, compute SHA-256, assemble release body with latest CHANGELOG snippet, “Full Changelog” compare link, and attach .sha256 alongside the zip. +- THIRD_PARTY.md: document ReDoc vendoring and rationale. + +Refs: #security #csp #release + +--- + ## Changes 10/27/2025 (v1.6.9) release(v1.6.9): feat(core) localize assets, harden headers, and speed up load diff --git a/README.md b/README.md index b84b8f6..bc08f13 100644 --- a/README.md +++ b/README.md @@ -139,7 +139,7 @@ docker run -d \ -e DATE_TIME_FORMAT="m/d/y h:iA" \ -e TOTAL_UPLOAD_SIZE="5G" \ -e SECURE="false" \ - -e PERSISTENT_TOKENS_KEY="please_change_this_@@" \ + -e PERSISTENT_TOKENS_KEY="default_please_change_this_key" \ -e PUID="1000" \ -e PGID="1000" \ -e CHOWN_ON_START="true" \ @@ -186,7 +186,7 @@ services: DATE_TIME_FORMAT: "m/d/y h:iA" TOTAL_UPLOAD_SIZE: "10G" SECURE: "false" - PERSISTENT_TOKENS_KEY: "please_change_this_@@" + PERSISTENT_TOKENS_KEY: "default_please_change_this_key" # Ownership & indexing PUID: "1000" # Unraid users often use 99 PGID: "1000" # Unraid users often use 100 diff --git a/THIRD_PARTY.md b/THIRD_PARTY.md index 59f2e1c..30d3da7 100644 --- a/THIRD_PARTY.md +++ b/THIRD_PARTY.md @@ -37,6 +37,10 @@ If you believe any attribution is missing or incorrect, please open an issue. - **Resumable.js 1.1.0** — MIT License **Files:** `public/vendor/resumable/1.1.0/resumable.min.js` +- **ReDoc (redoc.standalone.js)** — MIT License + **Files:** `public/vendor/redoc/redoc.standalone.js` + **Notes:** Self-hosted to comply with `script-src 'self'` CSP. + > MIT-licensed code: see `licenses/mit.txt`. > Apache-2.0–licensed code: see `licenses/apache-2.0.txt`. diff --git a/public/api.php b/public/api.php index 4e1b41e..cae06e3 100644 --- a/public/api.php +++ b/public/api.php @@ -19,13 +19,15 @@ if (isset($_GET['spec'])) {