CaIon 20399d3c8f fix: harden SSRF protection for unauthenticated and user-level endpoints ...

- Add ValidateURLWithFetchSetting check before fetching MJ image URLs
  in RelayMidjourneyImage (unauthenticated endpoint)
- Add ValidateURLWithFetchSetting check before fetching video URLs
  in VideoProxy (upstream-controlled URL)
- Enable ApplyIPFilterForDomain by default to prevent DNS rebinding
  bypass of SSRF protection
- Elevate FetchModels endpoint from AdminAuth to RootAuth
- Update frontend: mark domain IP filtering as recommended, update
  description and i18n translations (zh-CN/zh-TW/en/fr/ja/ru/vi)

2026-03-31 17:57:47 +08:00

..

config

fix: harden token search with pagination, rate limiting and input validation

2026-02-06 17:52:19 +08:00

console_setting

format: package name -> github.com/QuantumNous/new-api (#2017)

2025-10-11 15:30:09 +08:00

model_setting

feat: enhance Claude request header handling with append functionality

2026-03-09 23:47:51 +08:00

operation_setting

fix: default codex and claude channel affinity templates to skip retry on failure

2026-03-19 16:56:28 +08:00

performance_setting

fix: raise default overload disk threshold to 95%

2026-03-19 16:58:13 +08:00

ratio_setting

fix: increase StreamScannerMaxBufferMB limit and add handling for gpt-5.4-nano prefix

2026-03-22 13:55:10 +08:00

reasoning

feat: support adaptive thinking

2026-02-06 11:01:23 +08:00

system_setting

fix: harden SSRF protection for unauthenticated and user-level endpoints

2026-03-31 17:57:47 +08:00

auto_group.go

feat: add special user usable group setting

2025-10-28 23:25:43 +08:00

chat.go

feat: add AionUI to chat settings and built-in templates

2026-03-02 21:19:04 +08:00

midjourney.go

feat: Introduce settings package and refactor constants

2024-12-22 17:24:29 +08:00

payment_creem.go

完善 订单处理，以及 优化 ui

2025-09-16 22:35:46 +08:00

payment_stripe.go

feat: allow stripe promotion code

2025-09-27 15:43:12 +08:00

payment_waffo.go

feat(waffo): Waffo payment gateway integration with configurable methods

2026-03-17 18:04:58 +08:00

rate_limit.go

format: package name -> github.com/QuantumNous/new-api (#2017)

2025-10-11 15:30:09 +08:00

sensitive.go

feat: Introduce settings package and refactor constants

2024-12-22 17:24:29 +08:00

user_usable_group.go

feat: add special user usable group setting

2025-10-28 23:25:43 +08:00