merge upstream/master into oadp-dev - #30
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Joeavaikath The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (10)
📒 Files selected for processing (81)
💤 Files with no reviewable changes (7)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughThe change set updates backend security and path handling, user provisioning, TUS uploads, frontend accessibility and upload flows, archive messaging, documentation generation, release notes, and Go module versions. ChangesBackend security and path handling
Frontend accessibility and upload behavior
Repository maintenance and documentation
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant HTTPHandler
participant PathCanonicalizer
participant RuleChecker
participant ScopedFilesystem
Client->>HTTPHandler: request resource path
HTTPHandler->>PathCanonicalizer: canonicalizeRequestPath
PathCanonicalizer-->>HTTPHandler: normalized path
HTTPHandler->>RuleChecker: CheckRules(normalized path)
RuleChecker->>ScopedFilesystem: case-aware path and rule evaluation
ScopedFilesystem-->>RuleChecker: authorization result
RuleChecker-->>HTTPHandler: allow or deny
HTTPHandler-->>Client: resource response
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
… home
Proxy- and hook-authenticated users were auto-provisioned by applying the
default scope (".") and passing it straight to MakeUserDir, which normalizes
"." to "/". With CreateUserDir enabled, every provisioned user therefore
received the server root as its scope instead of a per-user home directory,
letting one user read, overwrite and delete another user's files.
The signup handler already cleared the scope before deriving the home
directory. Centralize that logic into Settings.CreateUserHome (clear the
scope when CreateUserDir is on and no explicit scope was supplied, derive the
home dir, then reject a scope already owned by another user) and use it from
signup, proxy and hook auth so the three provisioning paths cannot diverge.
Refs GHSA-j7jh-37pf-mf8h, GHSA-j2fc-28fx-hc8q
GetByScope compared scopes with a case-sensitive exact match, so on a case-insensitive filesystem two accounts whose scopes differ only in case (e.g. /users/CaseVictim and /users/casevictim) were treated as distinct even though both resolve to the same physical home directory. The second account could then read, overwrite and delete the first account's files. Match the scope case-insensitively so the collision check performed during signup, proxy and hook provisioning catches these aliases and rejects the duplicate. Refs GHSA-576v-w77m-gr84
The ?checksum= branch of the resource GET handler read the whole file to compute its digest and returned it without checking Perm.Download, unlike the sibling raw, preview, subtitle and X-Encoding paths. A user provisioned with Perm.Download=false could therefore obtain md5/sha1/sha256/sha512 digests of files they are not allowed to download, giving a file-content hash oracle, and force a full-file read. Return 202 Accepted before computing the checksum when the user lacks Perm.Download, matching the other read paths. This completes the fix for CVE-2026-35606, whose original patch gated only the content-returning paths. Refs GHSA-7whw-q6gh-xr59
The in-memory upload cache deleted expired incomplete uploads with a raw os.Remove on the absolute path it had stored, bypassing ScopedFs entirely. Because the stored path is only lexically cleaned (no symlink evaluation) and os.Remove resolves symlinked parent directories, a Create-only user could register an upload and then, within the 3-minute TTL, swap an in-scope ancestor directory for a symlink so the eviction deleted an arbitrary file outside their scope. Carry a removal callback with each cache entry and invoke it on eviction instead of os.Remove. For TUS uploads the callback deletes via the uploading user's scoped filesystem, whose Remove is guarded by the same within() check that CVE-2026-55667 added, so eviction can no longer follow a symlink out of scope. The redis backend ignores the callback (it never deleted partial files). Refs GHSA-m9f5-2232-frp6
The TUS PATCH handler copied the whole request body to disk and used the declared Upload-Length only to decide when the upload was complete. A client could declare a tiny Upload-Length and then stream an arbitrarily large body in a single PATCH, writing it all to disk, so any user with create permission could exhaust the filesystem. Bound each write to the bytes still expected (Upload-Length - Upload-Offset), reject a PATCH whose offset already exceeds the declared length, and roll back and reject a body that exceeds it. This complements the existing negative Upload-Length handling. Refs GHSA-ffv3-7h97-993q
…oning Unit tests for Settings.CreateUserHome (derives a per-user home, rejects a colliding scope, preserves an explicit scope) plus proxy and hook regression tests asserting that with CreateUserDir enabled two provisioned users receive distinct home directories instead of the server root. Refs GHSA-j7jh-37pf-mf8h, GHSA-j2fc-28fx-hc8q
The check that stops two usernames normalizing to the same home directory ran as a storage operation separate from the save, so two first-time users provisioned concurrently could both observe a free scope and both be saved into it, ending up sharing one home directory. Move the check into users.Storage.SaveProvisioned, which holds a single lock across the lookup and the save, and reduce CreateUserHome to deriving and creating the directory. This covers all three provisioning paths: signup, proxy auth and hook auth. Refs GHSA-j7jh-37pf-mf8h
Two usernames that normalize to the same home directory must not both be provisioned when their requests are handled concurrently. Also cover that an explicit, non-derived scope may still be legitimately shared. Refs GHSA-j7jh-37pf-mf8h
|
/retest |
f1469cd to
ea684ea
Compare
New config option: --branding.disableUserProfile This option allows to disable User Profile together with User settings. Signed-off-by: Michal Pryc <mpryc@redhat.com>
New config option: --branding.defaultLoginUser "username" This option allows to provide default Username, which will result in hiding username field from the welcome page. Signed-off-by: Michal Pryc <mpryc@redhat.com>
Removes Help options "Delete" and "Rename" if the following permissions are revoked from a particular user: --perm.delete=false --perm.rename=false Signed-off-by: Michal Pryc <mpryc@redhat.com>
Add multi-stage Containerfile for UBI-based builds. Signed-off-by: Michal Pryc <mpryc@redhat.com>
Adds OWNERS file. Signed-off-by: Michal Pryc <mpryc@redhat.com>
Fix downstream changes to match upstream refactored functions. Signed-off-by: Michal Pryc <mpryc@redhat.com>
Disable Validate Title check (semantic commit PR titles are not used downstream). Fix Go version to 1.25 and add oadp-* branches to CI triggers.
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.0.13 to 8.0.16. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 8.0.16 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.4 to 3.4.12. - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.4...3.4.12) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.4.12 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
ea684ea to
50ce15d
Compare
|
@Joeavaikath: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Note
Due to the large number of review comments, Critical, Major severity comments were prioritized as inline comments.
🟡 Minor comments (19)
http/tus_handlers.go-265-266 (1)
265-266: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winReject a declared upload length of
math.MaxInt64.When
Upload-Lengthis parsed asmath.MaxInt64,uploadOffset = 0makesremaining = math.MaxInt64; thenremaining+1wraps to-9223372036854775808before reachingio.LimitReader.io.LimitReadertreats that limit as non-positive and returnsEOFimmediately, so the PATCH can return500with unchanged offset for a valid body size. Add a POST rejection test for aUpload-Length: 9223372036854775807request.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@http/tus_handlers.go` around lines 265 - 266, Reject Upload-Length values equal to math.MaxInt64 during POST request validation before the upload is created, preventing overflow when the PATCH handler computes remaining+1 for io.LimitReader. Add a regression test covering a POST with Upload-Length 9223372036854775807 and assert it is rejected.frontend/src/views/settings/Global.vue-302-305 (1)
302-305: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winKeep
pendingChunkSizeinformattedChunkSize.get().
settings.tus.chunkSize = parseBytes(pendingChunkSize.value)inapplyChunkSizemakes the computed getter depend on settings and track a pending raw input, so a reactive change during the debounce timeout can restoreformatBytes(settings.value.tus.chunkSize)in form re-render. ReturnpendingChunkSize.valuewhile it is notnull, then use the committed formatted value afterapplyChunkSizeclears it. Add a component test that types20M, changes another setting before the timer fires, and checks that the input still contains20M.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@frontend/src/views/settings/Global.vue` around lines 302 - 305, Update formattedChunkSize.get() to return pendingChunkSize.value whenever it is not null, falling back to formatBytes(settings.value.tus.chunkSize) only after applyChunkSize clears the pending value. Add a component test covering typing “20M”, changing another setting before the debounce fires, and verifying the input remains “20M”.frontend/src/i18n/pt-pt.json-267-269 (1)
267-269: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winLocalize the archive notice in every affected locale.
The settings view displays these values directly, so non-English users receive an untranslated archive notice.
frontend/src/i18n/pt-pt.json#L267-L269: replace the three English values with Portuguese translations.frontend/src/i18n/zh-cn.json#L267-L269: replace the three English values with Simplified Chinese translations.frontend/src/i18n/de.json#L267-L269: replace the three English values with German translations.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@frontend/src/i18n/pt-pt.json` around lines 267 - 269, Localize the sunsetTitle, sunsetBody, and sunsetLink values in frontend/src/i18n/pt-pt.json lines 267-269 into Portuguese, frontend/src/i18n/zh-cn.json lines 267-269 into Simplified Chinese, and frontend/src/i18n/de.json lines 267-269 into German; preserve the existing archive date, security warning, and project-status meaning in each translation.frontend/src/i18n/fr.json-267-269 (1)
267-269: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winTranslate the new archival notice in every affected locale. The new settings messages remain in English in three non-English locale files.
frontend/src/i18n/fr.json#L267-L269: add French values forsunsetBody,sunsetLink, andsunsetTitle.frontend/src/i18n/hr.json#L267-L269: add Croatian values forsunsetBody,sunsetLink, andsunsetTitle.frontend/src/i18n/ko.json#L267-L269: add Korean values forsunsetBody,sunsetLink, andsunsetTitle.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@frontend/src/i18n/fr.json` around lines 267 - 269, Translate the archival notice values for sunsetBody, sunsetLink, and sunsetTitle in frontend/src/i18n/fr.json:267-269, frontend/src/i18n/hr.json:267-269, and frontend/src/i18n/ko.json:267-269 into French, Croatian, and Korean respectively, preserving the existing keys and message meaning.docs/cli/filebrowser-users-find.md-7-7 (1)
7-7: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winUse “argument” for the positional input.
The synopsis uses
<id|username>, but Line [7] says “flag”. If the no-input behavior is supported, change the sentence to “If no argument is provided, all users will be printed.” Otherwise, remove the sentence.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/filebrowser-users-find.md` at line 7, Update the description in the filebrowser users-find documentation to refer to the positional <id|username> input as an “argument,” not a “flag”; use the no-argument wording if that behavior is supported, otherwise remove the no-input sentence.docs/cli/filebrowser-users-import.md-7-10 (1)
7-10: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winClarify the import-file instruction.
The phrase “files list” does not identify the JSON or YAML field that contains the user ID. Name the exact field, or change the text to “the file’s user list” if that is intended.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/filebrowser-users-import.md` around lines 7 - 10, Clarify the user ID guidance in the import description by replacing the ambiguous “files list” phrase with the exact JSON/YAML field containing user IDs, or explicitly refer to “the file’s user list” if that is the intended structure. Keep the existing instruction to omit the ID or set it to 0.docs/cli/filebrowser-completion-bash.md-29-29 (1)
29-29: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winFix the generated CLI documentation lint contract once.
The new CLI pages contain the same MD040 and MD046 violations. Since
Taskfile.ymlgenerates these files withgo run . docs, fix the generator or exclude generateddocs/clioutput from the applicable markdownlint rules.
- docs/cli/filebrowser-completion-bash.md#L29-L29: apply the generator or lint configuration fix to Lines 29, 35, and 42.
- docs/cli/filebrowser-completion-fish.md#L20-L20: apply the generator or lint configuration fix to Lines 20, 26, and 33.
- docs/cli/filebrowser-users-export.md#L10-L10: apply the generator or lint configuration fix to Lines 10, 16, and 22.
- docs/cli/filebrowser-users-find.md#L9-L9: apply the generator or lint configuration fix to Lines 9, 15, and 21.
- docs/cli/filebrowser-users-import.md#L12-L12: apply the generator or lint configuration fix to Lines 12, 18, and 26.
- docs/cli/filebrowser-users-ls.md#L5-L5: apply the generator or lint configuration fix to Lines 5, 11, and 17.
- docs/cli/filebrowser-users-rm.md#L9-L9: apply the generator or lint configuration fix to Lines 9, 15, and 21.
- docs/cli/filebrowser-users-update.md#L10-L10: apply the generator or lint configuration fix to Lines 10, 16, and 44.
- docs/cli/filebrowser-users.md#L11-L11: apply the generator or lint configuration fix to Lines 11 and 17.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/filebrowser-completion-bash.md` at line 29, Fix the generated CLI documentation lint contract at the generator or markdownlint configuration level rather than editing individual outputs. Apply the change to docs/cli/filebrowser-completion-bash.md lines 29-29, 35, and 42; docs/cli/filebrowser-completion-fish.md lines 20, 26, and 33; docs/cli/filebrowser-users-export.md lines 10, 16, and 22; docs/cli/filebrowser-users-find.md lines 9, 15, and 21; docs/cli/filebrowser-users-import.md lines 12, 18, and 26; docs/cli/filebrowser-users-ls.md lines 5, 11, and 17; docs/cli/filebrowser-users-rm.md lines 9, 15, and 21; docs/cli/filebrowser-users-update.md lines 10, 16, and 44; and docs/cli/filebrowser-users.md lines 11 and 17, ensuring generated output no longer violates MD040 and MD046.Source: Linters/SAST tools
docs/cli/filebrowser.md-46-52 (1)
46-52: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winMake the generated Markdown pass the repository lint rules.
markdownlint-cli2reports MD040 and MD046 for these fenced code blocks. Update the documentation generator to emit the configured indented code-block style, or update the Markdown configuration if fenced blocks are intentional. Adding language identifiers alone fixes MD040 but still leaves MD046.
docs/cli/filebrowser.md#L46-L52: update the generated synopsis and option blocks.docs/cli/filebrowser-completion-powershell.md#L17-L33: update the command and option blocks.docs/cli/filebrowser-completion-zsh.md#L31-L47: update the command and option blocks.docs/cli/filebrowser-completion.md#L13-L19: update the option blocks.docs/cli/filebrowser-config-cat.md#L9-L21: update the synopsis and option blocks.docs/cli/filebrowser-config-export.md#L11-L23: update the synopsis and option blocks.docs/cli/filebrowser-version.md#L5-L17: update the synopsis and option blocks.docs/customization.md#L32-L39: update the directory-tree block.docs/cli/filebrowser-cmds.md#L11-L17: update the option blocks.docs/cli/filebrowser-cmds-ls.md#L9-L22: update the synopsis and option blocks.docs/cli/filebrowser-cmds-rm.md#L17-L29: update the synopsis and option blocks.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/filebrowser.md` around lines 46 - 52, Update the documentation generator or Markdown configuration so generated blocks use the repository’s configured indented code-block style, resolving both MD040 and MD046 rather than only adding language identifiers. Apply the generated formatting to docs/cli/filebrowser.md:46-52, docs/cli/filebrowser-completion-powershell.md:17-33, docs/cli/filebrowser-completion-zsh.md:31-47, docs/cli/filebrowser-completion.md:13-19, docs/cli/filebrowser-config-cat.md:9-21, docs/cli/filebrowser-config-export.md:11-23, docs/cli/filebrowser-version.md:5-17, docs/customization.md:32-39, docs/cli/filebrowser-cmds.md:11-17, docs/cli/filebrowser-cmds-ls.md:9-22, and docs/cli/filebrowser-cmds-rm.md:17-29.Source: Linters/SAST tools
docs/cli/filebrowser.md-13-14 (1)
13-14: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winFix the CLI description source before regenerating
docs/cli/filebrowser.md.The source strings in
cmd/root.gostill produce:
single file database→ usesingle-file databaseuse the noauth auther when using quick setup→ useuse the noauth auth method when using quick setupRegenerate the docs after updating those descriptions.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/filebrowser.md` around lines 13 - 14, Update the CLI description strings in cmd/root.go to use “single-file database” and replace “noauth auther” with “noauth auth method,” then regenerate docs/cli/filebrowser.md from the updated CLI definitions.Source: Linters/SAST tools
docs/cli/filebrowser-rules-ls.md-3-7 (1)
3-7: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winUse the hyphenated term
user-specific.Apply
user-specificin both the command description and the synopsis.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/filebrowser-rules-ls.md` around lines 3 - 7, Update the command description and synopsis in the filebrowser rules documentation to use the hyphenated term “user-specific” instead of “user specific,” preserving the rest of the wording.Source: Linters/SAST tools
docs/cli/filebrowser-config-init.md-7-11 (1)
7-11: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winCorrect the initialization synopsis wording.
Change
All of this optionstoAll of these options. Changeuser related flagstouser-related flags. Regenerate this page from the corrected command description.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/filebrowser-config-init.md` around lines 7 - 11, Update the initialization synopsis in the command description to use “All of these options” and “user-related flags,” then regenerate the filebrowser-config-init documentation page from that corrected description.Source: Linters/SAST tools
docs/cli/filebrowser-config-import.md-7-14 (1)
7-14: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winCorrect the import synopsis wording.
Line 8 is not a complete sentence, and
unexisting databasesis incorrect usage. Use wording such asIt can be used with or without an existing database.in the command description, then regenerate this page.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/filebrowser-config-import.md` around lines 7 - 14, Update the import command description in the filebrowser configuration documentation to use complete, grammatically correct wording, including “It can be used with or without an existing database.” Preserve the surrounding behavior details, then regenerate the page using the project’s documentation generation process.Source: Linters/SAST tools
docs/cli/filebrowser-rules.md-7-11 (1)
7-11: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winCorrect the user-scope wording.
Change
an usertoa user. Changeuser specific rulestouser-specific rules.Also applies to: 30-33
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/filebrowser-rules.md` around lines 7 - 11, Update the user-scope wording in the subcommand flag documentation: replace “an user” with “a user” and hyphenate “user specific rules” as “user-specific rules” in all affected occurrences, including the additional referenced section.Source: Linters/SAST tools
CONTRIBUTING.md-94-94 (1)
94-94: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winUse future tense for the Transifex cutoff.
As of August 10, 2026, the integration has not reached the stated September 1, 2026 stop date. The current wording directs contributors to edit locale files directly too early and conflicts with
.github/PULL_REQUEST_TEMPLATE.mdLine 14. State that the integration will stop on September 1, 2026, and that direct edits apply after that date.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@CONTRIBUTING.md` at line 94, Update the Transifex integration notice in CONTRIBUTING.md to use future tense: state that it will stop on September 1, 2026, and instruct contributors to edit locale files directly only after that date.README.md-5-7 (1)
5-7: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winAdd alternative text to the banner image.
Add concise
alttext to the<img>element. Usealt=""if the banner is decorative.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@README.md` around lines 5 - 7, Update the banner image in the README’s centered image markup to include concise alternative text via the img element’s alt attribute, using an empty value only if the banner is purely decorative.Source: Linters/SAST tools
CHANGELOG.md-5-8 (1)
5-8: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winDo not leave release 2.63.23 empty.
The
2.63.23heading is immediately followed by2.63.22, so the Bug Fixes section at Line 8 is attributed to2.63.22. Move the Bug Fixes section under2.63.23, or remove the empty release heading.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@CHANGELOG.md` around lines 5 - 8, Update the changelog ordering around releases 2.63.23 and 2.63.22 so the Bug Fixes section is explicitly associated with 2.63.23; place the section beneath the 2.63.23 heading, or remove that heading if no fixes belong to the release.docs/README.md-2-2 (1)
2-2: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winAdd alternate text to the banner image.
Line 2 has no
altattribute. Screen readers cannot identify the image, andmarkdownlint-cli2reports MD045. Add descriptive text, or usealt=""if the banner is decorative.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/README.md` at line 2, Update the banner image markup in the README to include an alt attribute, using concise descriptive text for an informative banner or an empty value if it is decorative, so the image is accessible and satisfies MD045.Source: Linters/SAST tools
docs/cli/filebrowser-cmds-add.md-9-9 (1)
9-9: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winAdd language identifiers to the fenced code blocks.
markdownlintreports MD040 on Lines 9, 15, and 21. Usetextfor these CLI documentation blocks.Also applies to: 15-15, 21-21
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/filebrowser-cmds-add.md` at line 9, Add the `text` language identifier to the fenced code blocks in the documentation, including the blocks around the CLI examples at lines 9, 15, and 21, so each fence satisfies markdownlint MD040.Source: Linters/SAST tools
docs/command-execution.md-28-28 (1)
28-28: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winPreserve
$FILEuntil hook execution.Because this block uses Bash,
filebrowser cmds add before_copy "echo $FILE"expands$FILEin the caller's shell. Pass the command with single quotes around the outer argument:Proposed fix
-filebrowser cmds add before_copy "echo $FILE" +filebrowser cmds add before_copy 'echo "$FILE"'🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/command-execution.md` at line 28, Update the before_copy hook command example so the $FILE variable is preserved until hook execution by using single quotes around the outer command argument, preventing expansion by the caller’s shell.
🧹 Nitpick comments (11)
docs/cli/filebrowser-hash.md (1)
9-11: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd language identifiers to the fenced CLI output.
The three fenced blocks omit language identifiers. Add
textor another suitable identifier in the documentation-generation output so markdownlint MD040 passes after regeneration.Also applies to: 15-17, 21-24
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/filebrowser-hash.md` around lines 9 - 11, Update the documentation-generation output for all three fenced CLI blocks in filebrowser-hash.md to include a suitable language identifier such as text, preserving their existing contents so the regenerated Markdown passes MD040.Source: Linters/SAST tools
docs/cli/filebrowser-config.md (1)
11-13: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd language identifiers to the fenced CLI output.
The two fenced blocks omit language identifiers. Add
textor another suitable identifier in the documentation-generation output so markdownlint MD040 passes after regeneration.Also applies to: 17-20
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/filebrowser-config.md` around lines 11 - 13, Add a suitable language identifier, such as text, to both fenced CLI output blocks in the generated filebrowser configuration documentation, including the block containing “-h, --help help for config,” and update the documentation-generation source so regeneration preserves the identifiers.Source: Linters/SAST tools
docs/cli/filebrowser-rules.md (1)
15-19: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd language identifiers to the fenced CLI output.
The two fenced blocks omit language identifiers. Add
textor another suitable identifier in the documentation-generation output so markdownlint MD040 passes after regeneration.Also applies to: 23-26
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/filebrowser-rules.md` around lines 15 - 19, Add a suitable language identifier, such as text, to both fenced CLI output blocks in the generated documentation so each opening fence satisfies markdownlint MD040; preserve the command output content unchanged.Source: Linters/SAST tools
docs/cli/filebrowser-config-import.md (2)
16-18: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd language identifiers to the fenced CLI output.
The three fenced blocks omit language identifiers. Add
textor another suitable identifier in the documentation-generation output so markdownlint MD040 passes after regeneration.Also applies to: 22-24, 28-31
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/filebrowser-config-import.md` around lines 16 - 18, Update the fenced CLI output blocks in the generated documentation so each opening fence includes a language identifier, using text or another suitable identifier. Apply this consistently to all three blocks shown around the command usage examples, preserving their contents so markdownlint MD040 passes after regeneration.Source: Linters/SAST tools
16-31: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winFix unnamed fenced code blocks at the documentation-generation source.
All listed pages contain fenced CLI output without language identifiers. markdownlint reports MD040. Add
textor another suitable language identifier to each generated fence, then regenerate the pages.
docs/cli/filebrowser-config-import.md#L16-L31: update the three CLI output fences.docs/cli/filebrowser-config-init.md#L13-L85: update the three CLI output fences.docs/cli/filebrowser-config-set.md#L10-L82: update the three CLI output fences.docs/cli/filebrowser-config.md#L11-L20: update the two CLI output fences.docs/cli/filebrowser-hash.md#L9-L24: update the three CLI output fences.docs/cli/filebrowser-rules-add.md#L9-L28: update the three CLI output fences.docs/cli/filebrowser-rules-ls.md#L9-L26: update the three CLI output fences.docs/cli/filebrowser-rules-rm.md#L17-L35: update the three CLI output fences.docs/cli/filebrowser-rules.md#L15-L26: update the two CLI output fences.docs/cli/filebrowser-users-add.md#L9-L44: update the three CLI output fences.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/filebrowser-config-import.md` around lines 16 - 31, Update the documentation-generation source so every generated CLI output fence has a language identifier such as text, then regenerate the affected pages. Apply this to all three fences in docs/cli/filebrowser-config-import.md (16-31), docs/cli/filebrowser-config-init.md (13-85), docs/cli/filebrowser-config-set.md (10-82), docs/cli/filebrowser-hash.md (9-24), docs/cli/filebrowser-rules-add.md (9-28), docs/cli/filebrowser-rules-ls.md (9-26), and docs/cli/filebrowser-users-add.md (9-44), and both fences in docs/cli/filebrowser-config.md (11-20), docs/cli/filebrowser-rules.md (15-26), and docs/cli/filebrowser-rules-rm.md (17-35).Source: Linters/SAST tools
docs/cli/filebrowser-users-add.md (1)
9-11: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd language identifiers to the fenced CLI output.
The three fenced blocks omit language identifiers. Add
textor another suitable identifier in the documentation-generation output so markdownlint MD040 passes after regeneration.Also applies to: 15-37, 41-44
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/filebrowser-users-add.md` around lines 9 - 11, Add a suitable language identifier, preferably text, to the fenced CLI code blocks in the generated documentation, including the blocks around the users add command and the additional affected ranges, so every fence satisfies markdownlint MD040 after regeneration.Source: Linters/SAST tools
docs/cli/filebrowser-rules-ls.md (1)
9-11: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd language identifiers to the fenced CLI output.
The three fenced blocks omit language identifiers. Add
textor another suitable identifier in the documentation-generation output so markdownlint MD040 passes after regeneration.Also applies to: 15-17, 21-26
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/filebrowser-rules-ls.md` around lines 9 - 11, Update the documentation-generation output for the fenced CLI blocks in filebrowser rules ls to include a suitable language identifier such as text, including all three referenced blocks, so regenerated Markdown passes MD040.Source: Linters/SAST tools
docs/cli/filebrowser-rules-rm.md (1)
17-19: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd language identifiers to the fenced CLI output.
The three fenced blocks omit language identifiers. Add
textor another suitable identifier in the documentation-generation output so markdownlint MD040 passes after regeneration.Also applies to: 23-26, 30-35
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/filebrowser-rules-rm.md` around lines 17 - 19, Add a suitable language identifier, preferably text, to each fenced CLI output block generated for the rules rm documentation, including the blocks covering the usage and examples. Ensure the source template or documentation-generation output is updated so regeneration preserves the identifiers and markdownlint MD040 passes.Source: Linters/SAST tools
docs/cli/filebrowser-config-init.md (1)
13-15: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd language identifiers to the fenced CLI output.
The three fenced blocks omit language identifiers. Add
textor another suitable identifier in the documentation-generation output so markdownlint MD040 passes after regeneration.Also applies to: 19-78, 82-85
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/filebrowser-config-init.md` around lines 13 - 15, Add a suitable language identifier, such as text, to every fenced CLI output block in the generated filebrowser configuration documentation, including the blocks covered by the additional ranges, so regenerated Markdown passes MD040.Source: Linters/SAST tools
docs/cli/filebrowser-config-set.md (1)
10-12: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd language identifiers to the fenced CLI output.
The three fenced blocks omit language identifiers. Add
textor another suitable identifier in the documentation-generation output so markdownlint MD040 passes after regeneration.Also applies to: 16-75, 79-82
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/filebrowser-config-set.md` around lines 10 - 12, Add a language identifier such as text to every fenced CLI output block in filebrowser-config-set.md, including the blocks covering all referenced ranges, and update the documentation-generation source or template so regeneration preserves the identifiers and satisfies markdownlint MD040.Source: Linters/SAST tools
docs/cli/filebrowser-rules-add.md (1)
9-11: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd language identifiers to the fenced CLI output.
The three fenced blocks omit language identifiers. Add
textor another suitable identifier in the documentation-generation output so markdownlint MD040 passes after regeneration.Also applies to: 15-19, 23-28
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/filebrowser-rules-add.md` around lines 9 - 11, Update the documentation-generation output for the fenced CLI blocks in filebrowser rules add so each opening fence includes a language identifier such as text. Apply the same change to all three fenced blocks and preserve their existing command content.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/deployment.md`:
- Around line 25-28: Update the Fail2ban filter example in the Definition block
by removing the backticks around the datepattern and failregex values, leaving
the regex contents unchanged so they match the documented log entries.
In `@frontend/src/stores/upload.ts`:
- Around line 113-134: Update processUploads and the upload completion flow
around finishUpload so a rejection from either api.post path records persistent
batch failure state rather than only the local succeeded value. When the queue
finishes, call buttons.success("upload") only if every upload succeeded, while
preserving the existing error-toast behavior and per-upload completion handling.
---
Minor comments:
In `@CHANGELOG.md`:
- Around line 5-8: Update the changelog ordering around releases 2.63.23 and
2.63.22 so the Bug Fixes section is explicitly associated with 2.63.23; place
the section beneath the 2.63.23 heading, or remove that heading if no fixes
belong to the release.
In `@CONTRIBUTING.md`:
- Line 94: Update the Transifex integration notice in CONTRIBUTING.md to use
future tense: state that it will stop on September 1, 2026, and instruct
contributors to edit locale files directly only after that date.
In `@docs/cli/filebrowser-cmds-add.md`:
- Line 9: Add the `text` language identifier to the fenced code blocks in the
documentation, including the blocks around the CLI examples at lines 9, 15, and
21, so each fence satisfies markdownlint MD040.
In `@docs/cli/filebrowser-completion-bash.md`:
- Line 29: Fix the generated CLI documentation lint contract at the generator or
markdownlint configuration level rather than editing individual outputs. Apply
the change to docs/cli/filebrowser-completion-bash.md lines 29-29, 35, and 42;
docs/cli/filebrowser-completion-fish.md lines 20, 26, and 33;
docs/cli/filebrowser-users-export.md lines 10, 16, and 22;
docs/cli/filebrowser-users-find.md lines 9, 15, and 21;
docs/cli/filebrowser-users-import.md lines 12, 18, and 26;
docs/cli/filebrowser-users-ls.md lines 5, 11, and 17;
docs/cli/filebrowser-users-rm.md lines 9, 15, and 21;
docs/cli/filebrowser-users-update.md lines 10, 16, and 44; and
docs/cli/filebrowser-users.md lines 11 and 17, ensuring generated output no
longer violates MD040 and MD046.
In `@docs/cli/filebrowser-config-import.md`:
- Around line 7-14: Update the import command description in the filebrowser
configuration documentation to use complete, grammatically correct wording,
including “It can be used with or without an existing database.” Preserve the
surrounding behavior details, then regenerate the page using the project’s
documentation generation process.
In `@docs/cli/filebrowser-config-init.md`:
- Around line 7-11: Update the initialization synopsis in the command
description to use “All of these options” and “user-related flags,” then
regenerate the filebrowser-config-init documentation page from that corrected
description.
In `@docs/cli/filebrowser-rules-ls.md`:
- Around line 3-7: Update the command description and synopsis in the
filebrowser rules documentation to use the hyphenated term “user-specific”
instead of “user specific,” preserving the rest of the wording.
In `@docs/cli/filebrowser-rules.md`:
- Around line 7-11: Update the user-scope wording in the subcommand flag
documentation: replace “an user” with “a user” and hyphenate “user specific
rules” as “user-specific rules” in all affected occurrences, including the
additional referenced section.
In `@docs/cli/filebrowser-users-find.md`:
- Line 7: Update the description in the filebrowser users-find documentation to
refer to the positional <id|username> input as an “argument,” not a “flag”; use
the no-argument wording if that behavior is supported, otherwise remove the
no-input sentence.
In `@docs/cli/filebrowser-users-import.md`:
- Around line 7-10: Clarify the user ID guidance in the import description by
replacing the ambiguous “files list” phrase with the exact JSON/YAML field
containing user IDs, or explicitly refer to “the file’s user list” if that is
the intended structure. Keep the existing instruction to omit the ID or set it
to 0.
In `@docs/cli/filebrowser.md`:
- Around line 46-52: Update the documentation generator or Markdown
configuration so generated blocks use the repository’s configured indented
code-block style, resolving both MD040 and MD046 rather than only adding
language identifiers. Apply the generated formatting to
docs/cli/filebrowser.md:46-52,
docs/cli/filebrowser-completion-powershell.md:17-33,
docs/cli/filebrowser-completion-zsh.md:31-47,
docs/cli/filebrowser-completion.md:13-19,
docs/cli/filebrowser-config-cat.md:9-21,
docs/cli/filebrowser-config-export.md:11-23,
docs/cli/filebrowser-version.md:5-17, docs/customization.md:32-39,
docs/cli/filebrowser-cmds.md:11-17, docs/cli/filebrowser-cmds-ls.md:9-22, and
docs/cli/filebrowser-cmds-rm.md:17-29.
- Around line 13-14: Update the CLI description strings in cmd/root.go to use
“single-file database” and replace “noauth auther” with “noauth auth method,”
then regenerate docs/cli/filebrowser.md from the updated CLI definitions.
In `@docs/command-execution.md`:
- Line 28: Update the before_copy hook command example so the $FILE variable is
preserved until hook execution by using single quotes around the outer command
argument, preventing expansion by the caller’s shell.
In `@docs/README.md`:
- Line 2: Update the banner image markup in the README to include an alt
attribute, using concise descriptive text for an informative banner or an empty
value if it is decorative, so the image is accessible and satisfies MD045.
In `@frontend/src/i18n/fr.json`:
- Around line 267-269: Translate the archival notice values for sunsetBody,
sunsetLink, and sunsetTitle in frontend/src/i18n/fr.json:267-269,
frontend/src/i18n/hr.json:267-269, and frontend/src/i18n/ko.json:267-269 into
French, Croatian, and Korean respectively, preserving the existing keys and
message meaning.
In `@frontend/src/i18n/pt-pt.json`:
- Around line 267-269: Localize the sunsetTitle, sunsetBody, and sunsetLink
values in frontend/src/i18n/pt-pt.json lines 267-269 into Portuguese,
frontend/src/i18n/zh-cn.json lines 267-269 into Simplified Chinese, and
frontend/src/i18n/de.json lines 267-269 into German; preserve the existing
archive date, security warning, and project-status meaning in each translation.
In `@frontend/src/views/settings/Global.vue`:
- Around line 302-305: Update formattedChunkSize.get() to return
pendingChunkSize.value whenever it is not null, falling back to
formatBytes(settings.value.tus.chunkSize) only after applyChunkSize clears the
pending value. Add a component test covering typing “20M”, changing another
setting before the debounce fires, and verifying the input remains “20M”.
In `@http/tus_handlers.go`:
- Around line 265-266: Reject Upload-Length values equal to math.MaxInt64 during
POST request validation before the upload is created, preventing overflow when
the PATCH handler computes remaining+1 for io.LimitReader. Add a regression test
covering a POST with Upload-Length 9223372036854775807 and assert it is
rejected.
In `@README.md`:
- Around line 5-7: Update the banner image in the README’s centered image markup
to include concise alternative text via the img element’s alt attribute, using
an empty value only if the banner is purely decorative.
---
Nitpick comments:
In `@docs/cli/filebrowser-config-import.md`:
- Around line 16-18: Update the fenced CLI output blocks in the generated
documentation so each opening fence includes a language identifier, using text
or another suitable identifier. Apply this consistently to all three blocks
shown around the command usage examples, preserving their contents so
markdownlint MD040 passes after regeneration.
- Around line 16-31: Update the documentation-generation source so every
generated CLI output fence has a language identifier such as text, then
regenerate the affected pages. Apply this to all three fences in
docs/cli/filebrowser-config-import.md (16-31),
docs/cli/filebrowser-config-init.md (13-85), docs/cli/filebrowser-config-set.md
(10-82), docs/cli/filebrowser-hash.md (9-24), docs/cli/filebrowser-rules-add.md
(9-28), docs/cli/filebrowser-rules-ls.md (9-26), and
docs/cli/filebrowser-users-add.md (9-44), and both fences in
docs/cli/filebrowser-config.md (11-20), docs/cli/filebrowser-rules.md (15-26),
and docs/cli/filebrowser-rules-rm.md (17-35).
In `@docs/cli/filebrowser-config-init.md`:
- Around line 13-15: Add a suitable language identifier, such as text, to every
fenced CLI output block in the generated filebrowser configuration
documentation, including the blocks covered by the additional ranges, so
regenerated Markdown passes MD040.
In `@docs/cli/filebrowser-config-set.md`:
- Around line 10-12: Add a language identifier such as text to every fenced CLI
output block in filebrowser-config-set.md, including the blocks covering all
referenced ranges, and update the documentation-generation source or template so
regeneration preserves the identifiers and satisfies markdownlint MD040.
In `@docs/cli/filebrowser-config.md`:
- Around line 11-13: Add a suitable language identifier, such as text, to both
fenced CLI output blocks in the generated filebrowser configuration
documentation, including the block containing “-h, --help help for config,” and
update the documentation-generation source so regeneration preserves the
identifiers.
In `@docs/cli/filebrowser-hash.md`:
- Around line 9-11: Update the documentation-generation output for all three
fenced CLI blocks in filebrowser-hash.md to include a suitable language
identifier such as text, preserving their existing contents so the regenerated
Markdown passes MD040.
In `@docs/cli/filebrowser-rules-add.md`:
- Around line 9-11: Update the documentation-generation output for the fenced
CLI blocks in filebrowser rules add so each opening fence includes a language
identifier such as text. Apply the same change to all three fenced blocks and
preserve their existing command content.
In `@docs/cli/filebrowser-rules-ls.md`:
- Around line 9-11: Update the documentation-generation output for the fenced
CLI blocks in filebrowser rules ls to include a suitable language identifier
such as text, including all three referenced blocks, so regenerated Markdown
passes MD040.
In `@docs/cli/filebrowser-rules-rm.md`:
- Around line 17-19: Add a suitable language identifier, preferably text, to
each fenced CLI output block generated for the rules rm documentation, including
the blocks covering the usage and examples. Ensure the source template or
documentation-generation output is updated so regeneration preserves the
identifiers and markdownlint MD040 passes.
In `@docs/cli/filebrowser-rules.md`:
- Around line 15-19: Add a suitable language identifier, such as text, to both
fenced CLI output blocks in the generated documentation so each opening fence
satisfies markdownlint MD040; preserve the command output content unchanged.
In `@docs/cli/filebrowser-users-add.md`:
- Around line 9-11: Add a suitable language identifier, preferably text, to the
fenced CLI code blocks in the generated documentation, including the blocks
around the users add command and the additional affected ranges, so every fence
satisfies markdownlint MD040 after regeneration.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: b7522968-a2c6-4536-9069-022bab357ed7
⛔ Files ignored due to path filters (10)
docs/static/1.jpgis excluded by!**/*.jpgdocs/static/2.jpgis excluded by!**/*.jpgdocs/static/3.jpgis excluded by!**/*.jpgdocs/static/4.jpgis excluded by!**/*.jpgdocs/static/5.jpgis excluded by!**/*.jpgdocs/static/6.jpgis excluded by!**/*.jpgdocs/static/example.gifis excluded by!**/*.gifdocs/static/favicon.pngis excluded by!**/*.pngdocs/static/logo.pngis excluded by!**/*.pngfrontend/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (81)
.github/PULL_REQUEST_TEMPLATE.md.github/workflows/docs.ymlCHANGELOG.mdCONTRIBUTING.mdREADME.mdSECURITY.mdTaskfile.ymlcmd/docs.gocmd/root.godocs/README.mddocs/authentication.mddocs/cli/filebrowser-cmds-add.mddocs/cli/filebrowser-cmds-ls.mddocs/cli/filebrowser-cmds-rm.mddocs/cli/filebrowser-cmds.mddocs/cli/filebrowser-completion-bash.mddocs/cli/filebrowser-completion-fish.mddocs/cli/filebrowser-completion-powershell.mddocs/cli/filebrowser-completion-zsh.mddocs/cli/filebrowser-completion.mddocs/cli/filebrowser-config-cat.mddocs/cli/filebrowser-config-export.mddocs/cli/filebrowser-config-import.mddocs/cli/filebrowser-config-init.mddocs/cli/filebrowser-config-set.mddocs/cli/filebrowser-config.mddocs/cli/filebrowser-hash.mddocs/cli/filebrowser-rules-add.mddocs/cli/filebrowser-rules-ls.mddocs/cli/filebrowser-rules-rm.mddocs/cli/filebrowser-rules.mddocs/cli/filebrowser-users-add.mddocs/cli/filebrowser-users-export.mddocs/cli/filebrowser-users-find.mddocs/cli/filebrowser-users-import.mddocs/cli/filebrowser-users-ls.mddocs/cli/filebrowser-users-rm.mddocs/cli/filebrowser-users-update.mddocs/cli/filebrowser-users.mddocs/cli/filebrowser-version.mddocs/cli/filebrowser.mddocs/command-execution.mddocs/customization.mddocs/deployment.mddocs/installation.mddocs/troubleshooting.mdfrontend/public/index.htmlfrontend/src/components/prompts/Upload.vuefrontend/src/css/base.cssfrontend/src/css/mobile.cssfrontend/src/i18n/de.jsonfrontend/src/i18n/en.jsonfrontend/src/i18n/fr.jsonfrontend/src/i18n/hr.jsonfrontend/src/i18n/ko.jsonfrontend/src/i18n/nl.jsonfrontend/src/i18n/pl.jsonfrontend/src/i18n/pt-pt.jsonfrontend/src/i18n/zh-cn.jsonfrontend/src/stores/upload.tsfrontend/src/utils/__tests__/check-conflict.test.tsfrontend/src/utils/upload.tsfrontend/src/views/Settings.vuefrontend/src/views/files/FileListing.vuefrontend/src/views/files/__tests__/upload-conflict-resolution.test.tsfrontend/src/views/settings/Global.vuehttp/auth.gohttp/auth_test.gohttp/data.gohttp/resource.gohttp/resource_recursive_test.gohttp/rules_recursive_test.gohttp/tus_handlers.gohttp/tus_multichunk_test.gohttp/utils.gorenovate.jsonwww/.gitignorewww/Dockerfilewww/docs/index.mdwww/mkdocs.ymlwww/requirements.txt
💤 Files with no reviewable changes (7)
- www/Dockerfile
- www/docs/index.md
- www/requirements.txt
- www/mkdocs.yml
- www/.gitignore
- renovate.json
- .github/workflows/docs.yml
🚧 Files skipped from review as they are similar to previous changes (2)
- frontend/src/views/files/tests/upload-conflict-resolution.test.ts
- http/utils.go
| const upload = nextUpload(); | ||
| let succeeded = true; | ||
|
|
||
| if (upload.type === "dir") { | ||
| await api.post(upload.path).catch($showError); | ||
| await api.post(upload.path).catch((err) => { | ||
| succeeded = false; | ||
| $showError(err); | ||
| }); | ||
| } else { | ||
| const onUpload = (event: ProgressEvent) => { | ||
| upload.rawProgress.sentBytes = event.loaded; | ||
| }; | ||
|
|
||
| await api | ||
| .post(upload.path, upload.file!, upload.overwrite, onUpload) | ||
| .catch((err) => err.message !== "Upload aborted" && $showError(err)); | ||
| .catch((err) => { | ||
| succeeded = false; | ||
| if (err.message !== "Upload aborted") $showError(err); | ||
| }); | ||
| } | ||
|
|
||
| finishUpload(upload); | ||
| finishUpload(upload, succeeded); |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Preserve failed-upload state until the batch completes.
If api.post rejects, succeeded remains local to this upload. finishUpload then discards it. When the queue drains, processUploads calls buttons.success("upload") at Line 100 even after a failed upload. This reports success after the error toast.
Track batch failure state. Do not call buttons.success("upload") when any upload in the batch failed.
Also applies to: 147-158
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@frontend/src/stores/upload.ts` around lines 113 - 134, Update processUploads
and the upload completion flow around finishUpload so a rejection from either
api.post path records persistent batch failure state rather than only the local
succeeded value. When the queue finishes, call buttons.success("upload") only if
every upload succeeded, while preserving the existing error-toast behavior and
per-upload completion handling.
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
🛑 Comments failed to post (1)
docs/deployment.md (1)
25-28: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash set -euo pipefail command -v fail2ban-regex >/dev/null tmpdir="$(mktemp -d)" trap 'rm -rf "$tmpdir"' EXIT cat >"$tmpdir/filebrowser-filter.conf" <<'EOF' [Definition] datepattern = `^%%Y\/%%m\/%%d %%H:%%M:%%S` failregex = `\/api\/login: 403 <HOST> *` EOF printf '%s\n' \ '2026/08/10 12:00:00 /api/login: 403 203.0.113.10' \ >"$tmpdir/filebrowser.log" fail2ban-regex \ "$tmpdir/filebrowser.log" \ "$tmpdir/filebrowser-filter.conf"Repository: migtools/filebrowser
Length of output: 158
🏁 Script executed:
#!/bin/bash set -euo pipefail printf 'Repository files matching deployment.md:\n' fd -a 'deployment\.md$' . || true printf '\nRelevant docs/deployment.md lines:\n' if [ -f docs/deployment.md ]; then sed -n '1,60p' docs/deployment.md | cat -n fi printf '\nSearch for fail2ban-filter config and backticks in repo:\n' rg -n "datepattern|failregex|filebrowser.*filter|403 <HOST>|DatePattern" . || trueRepository: migtools/filebrowser
Length of output: 2429
🏁 Script executed:
#!/bin/bash set -euo pipefail printf 'Documented fail2ban-regex test if present:\n' sed -n '240,350p' docs/deployment.md | cat -n | rg -n -C 2 "fail2ban-regex|datepattern|failregex|log" || true printf '\nInspect fail2ban availability and version:\n' command -v fail2ban-regex && fail2ban-regex --version 2>&1 || true tmpdir="$(mktemp -d)" trap 'rm -rf "$tmpdir"' EXIT log="$tmpdir/example.log" filter="$tmpdir/filter.conf" cat >"$filter" <<'EOF' [INCLUDES] before = common.conf [Definition] datepattern = `^%%Y\/%%m\/%%d %%H:%%M:%%S` failregex = `\/api\/login: 403 <HOST> *` EOF printf '%s\n' '2026/08/10 12:00:00 /api/login: 403 203.0.113.10' >"$log" if command -v fail2ban-regex >/dev/null; then fail2ban-regex "$log" "$filter" 2>&1 | sed -n '1,120p' fiRepository: migtools/filebrowser
Length of output: 245
🌐 Web query:
Fail2ban filter.ini datepattern failregex regex backticks literal value💡 Result:
In Fail2ban, datepattern and failregex utilize specific syntax rules for configuration files that differ from command-line usage. Key Syntax and Escaping Rules: 1. Percent Sign Escaping: In filter configuration files (e.g., filter.d/*.conf), the percent sign (%) used in datepattern directives must be escaped by a second percent sign (%%) [1][2][3]. For example, use %%Y for the year instead of %Y. This is required because Fail2ban uses string formatting on configuration files [1][4]. When testing with fail2ban-regex on the command line, use single percent signs (e.g., %Y) [4][5]. 2. Datepattern vs. Regex: The datepattern directive is not a standard raw regular expression, but a pattern that Fail2ban converts internally to match log timestamps [6][7]. It supports standard Python strptime-style directives (e.g., %d, %b, %Y, %H, %M, %S) [6][3]. If you need to match literal characters within a datepattern, they may need to be escaped, especially if they conflict with regex metacharacters (e.g., use (%%H:%%M:%%S) to match literal parentheses) [2]. 3. Literal Values and Backticks: Fail2ban does not use backticks (`) as a special operator for "literal" values within filter regexes. In fact, backticks are often treated as characters that may require escaping depending on the shell environment or specific filter context [8]. If you need to match a literal character that is also a regex metacharacter (like a period, bracket, or parenthesis), you must escape it with a backslash () [9]. 4. Best Practices: - Always define datepattern in the [Init] or [Definition] section of your filter file [1][10]. - Test your configurations using the fail2ban-regex tool [11]. When testing, it is often safer to point the tool directly at your filter file (e.g., fail2ban-regex /path/to/log /etc/fail2ban/filter.d/myfilter.conf) rather than passing the regex as a string argument, which can lead to shell-escaping ambiguities [12]. - Fail2ban extracts the timestamp matched by datepattern from the log line before the failregex is applied [9][6]. Therefore, your failregex should generally match the remaining part of the line [9][2]. - If your log does not contain a date, you can use datepattern = {NONE} to tell Fail2ban not to attempt date parsing [6][3]. Top Results: [9][1][4][5][6]
Citations:
- 1: fail2ban/fail2ban#564
- 2: fail2ban/fail2ban#2266
- 3: https://manpages.debian.org/bookworm/fail2ban/jail.conf.5.en.html
- 4: fail2ban/fail2ban#3500
- 5: fail2ban/fail2ban#1681
- 6: https://github.com/fail2ban/fail2ban/blob/master/man/jail.conf.5
- 7: https://stackoverflow.com/questions/56600288/fail2ban-datepattern-regex
- 8: https://deepwiki.com/fail2ban/fail2ban/5.2-tag-substitution-and-security
- 9: https://fail2ban.readthedocs.io/en/latest/filters.html
- 10: fail2ban/fail2ban#3062
- 11: https://github.com/fail2ban/fail2ban/blob/0a8356dd/man/fail2ban-regex.1
- 12: https://www.spinics.net/lists/fail2ban/msg02902.html
🏁 Script executed:
#!/bin/bash set -euo pipefail printf 'Logs containing initial fail2ban-regex output:\n' rg -n "fail2ban-regex|FileBrowser|example.log|failCount|Tests:|match by|datepattern|failregex" /tmp/coderabbit-shell-logs || true printf '\nRead-only probe: check temp file contents and exact patterns used by backticks:\n' tmpdir="$(mktemp -d)" trap 'rm -rf "$tmpdir"' EXIT cat >"$tmpdir/with_backticks.conf" <<'EOF' [Definition] datepattern = `^%%Y\/%%m\/%%d %%H:%%M:%%S` failregex = `\/api\/login: 403 <HOST> *` EOF cat >"$tmpdir/without_backticks.conf" <<'EOF' [Definition] datepattern = ^%%Y\/%%m\/%%d %%H:%%M:%%S failregex = \/api\/login: 403 <HOST> * EOF python3 - <<'PY' import re, pathlib for name in ("with_backticks.conf", "without_backticks.conf"): cfg = pathlib.Path(name).read_text() linepat = re.compile(r'^(datepattern|failregex)\s*=\s*(.*)$', re.M) matches = {m.group(1): m.group(2) for m in linepat.finditer(cfg)} print(name + ":") for key in ("datepattern", "failregex"): pat = matches[key] print(f" {key} = {pat!r}") log = "2026/08/10 12:00:00 /api/login: 403 203.0.113.10" for cfg in ("with_backticks.conf", "without_backticks.conf"): pat = pathlib.Path(cfg).read_text() print(f"\nlog={log!r} against failregex from {cfg}:") print("match=", bool(re.search(pat.strip(), log))) PYRepository: migtools/filebrowser
Length of output: 1342
🏁 Script executed:
#!/bin/bash set -euo pipefail tmpdir="$(mktemp -d)" trap 'rm -rf "$tmpdir"' EXIT cat >"$tmpdir/with_backticks.conf" <<'EOF' [Definition] datepattern = `^%%Y\/%%m\/%%d %%H:%%M:%%S` failregex = `\/api\/login: 403 <HOST> *` EOF cat >"$tmpdir/without_backticks.conf" <<'EOF' [Definition] datepattern = ^%%Y\/%%m\/%%d %%H:%%M:%%S failregex = \/api\/login: 403 <HOST> * EOF printf '\nRead-only probe: check temp file contents and exact regex behavior:\n' python3 - >"$tmpdir/probe.out" <<'PY' import re, pathlib for name in ["with_backticks.conf", "without_backticks.conf"]: cfg = pathlib.Path(name).read_text() linepat = re.compile(r'^(datepattern|failregex)\s*=\s*(.*)$', re.M) matches = {m.group(1): m.group(2) for m in linepat.finditer(cfg)} print(name + ":") for key in ("datepattern", "failregex"): pat = matches[key] print(f" {key} = {pat!r}") log = "2026/08/10 12:00:00 /api/login: 403 203.0.113.10" for cfg in ["with_backticks.conf", "without_backticks.conf"]: pat = pathlib.Path(cfg).read_text() print(f"\nlog={log!r} matched failregex from {cfg}: {bool(re.search(pat.strip(), log))}") PY cat "$tmpdir/probe.out" if command -v fail2ban-regex >/dev/null; then printf '\nExecutable fail2ban-regex probe:\n' fail2ban-regex "$tmpdir/without_backticks.conf" >"$tmpdir/f2b.out" 2>&1 || true sed -n '1,120p' "$tmpdir/f2b.out" fi printf '\nSearch for actual fail2ban-regex usage in docs/test files:\n' rg -n "fail2ban-regex|--file|--logpath|403 203\.|/api/login" . || trueRepository: migtools/filebrowser
Length of output: 757
🏁 Script executed:
#!/bin/bash set -euo pipefail set -x tmpdir="$(mktemp -d)" printf '%s\n' "$tmpdir" cat >"with_backticks.conf" <<'EOF' [Definition] datepattern = `^%%Y\/%%m\/%%d %%H:%%M:%%S` failregex = `\/api\/login: 403 <HOST> *` EOF cat >"without_backticks.conf" <<'EOF' [Definition] datepattern = ^%%Y\/%%m\/%%d %%H:%%M:%%S failregex = \/api\/login: 403 <HOST> * EOF python3 - <<'PY' import re, pathlib for name in ["with_backticks.conf", "without_backticks.conf"]: cfg = pathlib.Path(name).read_text() linepat = re.compile(r'^(datepattern|failregex)\s*=\s*(.*)$', re.M) matches = {m.group(1): m.group(2) for m in linepat.finditer(cfg)} print(name + ":") for key in ("datepattern", "failregex"): pat = matches[key] print(f" {key} = {pat!r}") PY python3 - <<'PY' import re, pathlib log = "2026/08/10 12:00:00 /api/login: 403 203.0.113.10" for cfg in ["with_backticks.conf", "without_backticks.conf"]: pat = pathlib.Path(cfg).read_text() print(f"\nlog={log!r} matched failregex from {cfg}: {bool(re.search(pat.strip(), log))}") PY if command -v fail2ban-regex >/dev/null; then fail2ban-regex ./without_backticks.conf fiRepository: migtools/filebrowser
Length of output: 768
🌐 Web query:
Fail2ban datepattern backticks failregex backticks datepattern fails with no matched💡 Result:
The issues you are experiencing with datepattern and failregex in Fail2Ban typically stem from a misunderstanding of how Fail2Ban processes log lines. When Fail2Ban parses a log, it first identifies the timestamp using the datepattern, removes it entirely from the string, and only then applies your failregex to the remaining portion [1][2][3][4]. If your failregex includes the date or is not anchored correctly after the timestamp is removed, it will fail to match [2][5]. Key troubleshooting and configuration points: 1. Remove Date from failregex: Ensure your failregex does not attempt to match the timestamp. If your regex includes the date, it will "miss" because that text has already been stripped [2][3]. 2. Use Correct Escaping: - In configuration files (.conf or.local), use double percent signs (%%) for datepattern tokens (e.g., %%Y, %%m, %%d) because single percent signs are used for internal variable interpolation [6][7][8]. - If testing via the command line (e.g., fail2ban-regex), use single percent signs (%) [6][7]. 3. Anchor Correctly: Because Fail2Ban cuts out the matched date, your failregex should generally begin with ^ (start of the remaining line) [1][9]. If you are using a non-standard format, explicitly anchoring your datepattern (e.g., ^\d{4}-\d{2}-\d{2}) helps ensure the parser does not misidentify parts of the line [5][10]. 4. Troubleshooting "no matched": - If you see "no valid date/time found," your datepattern does not match the format in your logs [7][8]. - Use the command fail2ban-regex (or provide the regex directly) to debug [1][11]. The output will tell you if the date template is hitting. - If the date matches but the regex doesn't, ensure you are testing against the log line after the date has been mentally removed [1][12]. Regarding the "backticks" mentioned in your query: Fail2Ban configuration files do not use backticks for regex or datepattern definition. Ensure you are using standard standard Python-compatible regular expression syntax [1][4]. If you were attempting to use backticks to shell-escape or define variables, this is not a supported syntax in Fail2Ban configuration [4][13]. Always verify your final regex using fail2ban-regex -v to see exactly how the line is being processed [6][5][3].
Citations:
- 1: http://fail2ban.readthedocs.org/en/latest/filters.html
- 2: fail2ban/fail2ban#2564
- 3: https://stackoverflow.com/questions/64782530/fail2ban-regex-not-matching-lines-in-log-file
- 4: https://github.com/fail2ban/fail2ban/blob/master/man/jail.conf.5
- 5: https://stackoverflow.com/questions/58199654/convert-log-string-into-regex-for-fail2ban
- 6: fail2ban/fail2ban#3500
- 7: fail2ban/fail2ban#2265
- 8: fail2ban/fail2ban#3075
- 9: https://github.com/fail2ban/fail2ban/blob/master/FILTERS
- 10: https://stackoverflow.com/questions/65540197/fail2ban-does-not-match-date-pattern
- 11: https://github.com/fail2ban/fail2ban/blob/0a8356dd/man/fail2ban-regex.1
- 12: https://fail2ban.readthedocs.io/en/latest/filters.html
- 13: fail2ban/fail2ban#2986
🏁 Script executed:
#!/bin/bash set -euo pipefail printf '\nSearch actual File Browser logging code for File Browser login log format and 403 logging:\n' rg -n "api/login|403|log\.Error|log\.Info|Printf|403|/api/login|login.*403" -S . || true printf '\nSearch docs/deployment.md content that may have actual Fail2ban regex examples:\n' sed -n '1,120p' docs/deployment.md | cat -nRepository: migtools/filebrowser
Length of output: 16516
Remove the backticks from the Fail2ban filter values.
Lines 26-27 are copied into a Fail2ban INI filter, so the backticks become literal parts of
datepatternandfailregex. Remove them so the patterns match real2026/08/10 12:00:00 ... /api/login: 403 ...log entries.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/deployment.md` around lines 25 - 28, Update the Fail2ban filter example in the Definition block by removing the backticks around the datepattern and failregex values, leaving the regex contents unchanged so they match the documented log entries.Source: MCP tools
This is an automated rebase PR generated by RebaseBot.
Summary
https://github.com/filebrowser/filebrowser:masterhttps://github.com/migtools/filebrowser:oadp-devLogs
View job log
Summary by CodeRabbit