Security: Upgrade multer from 1.4.5-lts.1 to 2.1.1 to fix DoS vulnerabilities

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
Fix: Add custom SMTP host/port/secure settings to fix AliyunQiye email connection error
2026-08-05 08:14:32 +08:00 · 2026-03-07 13:36:45 +00:00 · 2026-03-07 13:31:42 +00:00 · 2026-03-07 13:24:51 +00:00 · 2026-03-01 20:35:25 +08:00 · 2026-03-01 20:35:19 +08:00
15 changed files with 139 additions and 204 deletions
@@ -535,43 +535,12 @@ export async function setSystemTimezone(timezone: string): Promise<boolean> {
  }
 }

-// Helper function to check if a name is a GitHub URL
-function isGitHubUrl(name: string): boolean {
-  // Support git+https://, git+http://, https://, and http:// URLs
-  // This covers GitHub URLs and other git-compatible repositories
-  return !!name.match(/^(git\+https?:\/\/|https?:\/\/)/i);
-}
-
-// Helper function to check if a name is a requirements file
-function isRequirementsFile(name: string): boolean {
-  return !!name.match(/requirements.*\.(txt|in)$/i);
-}
-
-// Helper function to check if a name is a pyproject.toml file
-function isPyprojectToml(name: string): boolean {
-  return name.endsWith('pyproject.toml');
-}
-
 export function getGetCommand(type: DependenceTypes, name: string): string {
-  const trimmedName = name.trim();
-  
-  // For Python dependencies installed from GitHub or requirements files,
-  // we can't reliably check if they're installed, so skip the check
-  if (type === DependenceTypes.python3) {
-    if (isGitHubUrl(trimmedName) || 
-        isRequirementsFile(trimmedName) || 
-        isPyprojectToml(trimmedName)) {
-      // Return a command that will always indicate not installed
-      // This ensures GitHub URLs and requirements files are always installed
-      return 'echo ""';
-    }
-  }
-  
  const baseCommands = {
-    [DependenceTypes.nodejs]: `pnpm ls -g  | grep "${trimmedName}" | head -1`,
+    [DependenceTypes.nodejs]: `pnpm ls -g  | grep "${name}" | head -1`,
    [DependenceTypes.python3]: `
    python3 -c "exec('''
-name='${trimmedName}'
+name='${name}'
 try:
    from importlib.metadata import version
    print(version(name))
@@ -581,7 +550,7 @@ except:
    spec=u.find_spec(name)
    print(name if spec else '')
 ''')"`,
-    [DependenceTypes.linux]: `apk info -es ${trimmedName}`,
+    [DependenceTypes.linux]: `apk info -es ${name}`,
  };

  return baseCommands[type];
@@ -601,33 +570,7 @@ export function getInstallCommand(type: DependenceTypes, name: string): string {
    command = `${command} --prefix=${PYTHON_INSTALL_DIR}`;
  }

-  const trimmedName = name.trim();
-  
-  // Handle different installation methods for Python
-  if (type === DependenceTypes.python3) {
-    // Check if it's a GitHub URL (support both git+ and direct URLs)
-    if (isGitHubUrl(trimmedName)) {
-      return `${command} ${trimmedName}`;
-    }
-    // Check if it's a requirements file path
-    if (isRequirementsFile(trimmedName)) {
-      return `${command} -r ${trimmedName}`;
-    }
-    // Check if it's a pyproject.toml file
-    if (isPyprojectToml(trimmedName)) {
-      // For pyproject.toml, install from the directory containing it
-      const pathMatch = trimmedName.match(/^(.+)\/pyproject\.toml$/);
-      if (pathMatch) {
-        // Has a path prefix, use the directory
-        return `${command} ${pathMatch[1]}`;
-      } else {
-        // Just "pyproject.toml", install current directory
-        return `${command} .`;
-      }
-    }
-  }
-
-  return `${command} ${trimmedName}`;
+  return `${command} ${name.trim()}`;
 }

 export function getUninstallCommand(
@@ -116,6 +116,9 @@ export class EmailNotification extends NotificationBaseInfo {
  public emailUser: string = '';
  public emailPass: string = '';
  public emailTo: string = '';
+  public emailHost: string = '';
+  public emailPort: string = '';
+  public emailSecure: string = '';
 }

 export class PushMeNotification extends NotificationBaseInfo {
@@ -13,9 +13,29 @@ import { isValidToken } from '../shared/auth';
 import path from 'path';

 export default ({ app }: { app: Application }) => {
+  // Security: Enable strict routing to prevent case-insensitive path bypass
+  app.set('case sensitive routing', true);
+  app.set('strict routing', true);
  app.set('trust proxy', 'loopback');
  app.use(cors());
  
+  // Security: Path normalization middleware to prevent case variation attacks
+  app.use((req, res, next) => {
+    const originalPath = req.path;
+    const normalizedPath = originalPath.toLowerCase();
+    
+    // Block requests with case variations on protected paths
+    if (originalPath !== normalizedPath && 
+        (normalizedPath.startsWith('/api/') || normalizedPath.startsWith('/open/'))) {
+      return res.status(400).json({
+        code: 400,
+        message: 'Invalid path format'
+      });
+    }
+    
+    next();
+  });
+  
  // Rewrite URLs to strip baseUrl prefix if configured
  // This allows the rest of the app to work without baseUrl awareness
  if (config.baseUrl) {
@@ -36,7 +56,7 @@ export default ({ app }: { app: Application }) => {
      secret: config.jwt.secret,
      algorithms: ['HS384'],
    }).unless({
-      path: [...config.apiWhiteList, /^\/(?!api\/).*/],
+      path: [...config.apiWhiteList, /^(\/(?!api\/).*)$/i],
    }),
  );

@@ -51,19 +71,20 @@ export default ({ app }: { app: Application }) => {
  });

  app.use(async (req: Request, res, next) => {
-    if (!['/open/', '/api/'].some((x) => req.path.startsWith(x))) {
+    const pathLower = req.path.toLowerCase();
+    if (!['/open/', '/api/'].some((x) => pathLower.startsWith(x))) {
      return next();
    }

    const headerToken = getToken(req);
-    if (req.path.startsWith('/open/')) {
+    if (pathLower.startsWith('/open/')) {
      const apps = await shareStore.getApps();
      const doc = apps?.filter((x) =>
        x.tokens?.find((y) => y.value === headerToken),
      )?.[0];
      if (doc && doc.tokens && doc.tokens.length > 0) {
        const currentToken = doc.tokens.find((x) => x.value === headerToken);
-        const keyMatch = req.path.match(/\/open\/([a-z]+)\/*/);
+        const keyMatch = pathLower.match(/\/open\/([a-z]+)\/*/);
        const key = keyMatch && keyMatch[1];
        if (
          doc.scopes.includes(key as any) &&
@@ -98,7 +119,15 @@ export default ({ app }: { app: Application }) => {
  });

  app.use(async (req, res, next) => {
-    if (!['/api/user/init', '/api/user/notification/init'].includes(req.path)) {
+    const pathLower = req.path.toLowerCase();
+    if (
+      ![
+        '/api/user/init',
+        '/api/user/notification/init',
+        '/open/user/init',
+        '/open/user/notification/init',
+      ].includes(req.path)
+    ) {
      return next();
    }
    const authInfo =
@@ -13,7 +13,7 @@ import { AuthDataType, SystemModel } from '../data/system';
 import SystemService from '../services/system';
 import UserService from '../services/user';
 import { writeFile, readFile } from 'fs/promises';
-import { createRandomString, fileExist, safeJSONParse } from '../config/util';
+import { createRandomString, fileExist, isDemoEnv, safeJSONParse } from '../config/util';
 import OpenService from '../services/open';
 import { shareStore } from '../shared/store';
 import Logger from './logger';
@@ -50,7 +50,7 @@ export default async () => {
  const [authConfig] = await SystemModel.findOrCreate({
    where: { type: AuthDataType.authConfig },
  });
-  if (!authConfig?.info) {
+  if (!authConfig?.info || isDemoEnv()) {
    let authInfo = {
      username: 'admin',
      password: 'admin',
@@ -590,16 +590,46 @@ export default class NotificationService {
  }

  private async email() {
-    const { emailPass, emailService, emailUser, emailTo } = this.params;
+    const {
+      emailPass,
+      emailService,
+      emailUser,
+      emailTo,
+      emailHost,
+      emailPort,
+      emailSecure,
+    } = this.params;

    try {
-      const transporter = nodemailer.createTransport({
-        service: emailService,
+      const transportConfig: {
+        service?: string;
+        host?: string;
+        port?: number;
+        secure?: boolean;
+        auth: { user: string; pass: string };
+      } = {
        auth: {
          user: emailUser,
          pass: emailPass,
        },
-      });
+      };
+
+      if (emailHost) {
+        transportConfig.host = emailHost;
+        const parsedPort = emailPort ? parseInt(emailPort, 10) : NaN;
+        transportConfig.port =
+          !isNaN(parsedPort) && parsedPort >= 1 && parsedPort <= 65535
+            ? parsedPort
+            : 465;
+        transportConfig.secure =
+          emailSecure !== undefined && emailSecure !== ''
+            ? emailSecure === 'true'
+            : transportConfig.port === 465;
+      } else {
+        transportConfig.service = emailService;
+      }
+
+      const transporter = nodemailer.createTransport(transportConfig);

      const info = await transporter.sendMail({
        from: `"青龙快讯" <${emailUser}>`,
@@ -69,9 +69,10 @@ RUN git clone --depth=1 -b ${QL_BRANCH} ${QL_URL} ${QL_DIR} \

 ENV PNPM_HOME=${QL_DIR}/data/dep_cache/node \
  PYTHON_HOME=${QL_DIR}/data/dep_cache/python3 \
-  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3
+  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3 \
+  HOME=/root

-ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin \
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin:${HOME}/bin \
  NODE_PATH=/usr/local/bin:/usr/local/lib/node_modules:${PNPM_HOME}/global/5/node_modules \
  PIP_CACHE_DIR=${PYTHON_HOME}/pip \
  PYTHONPATH=${PYTHON_HOME}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}/site-packages
@@ -69,9 +69,10 @@ RUN git clone --depth=1 -b ${QL_BRANCH} ${QL_URL} ${QL_DIR} \

 ENV PNPM_HOME=${QL_DIR}/data/dep_cache/node \
  PYTHON_HOME=${QL_DIR}/data/dep_cache/python3 \
-  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3
+  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3 \
+  HOME=/root

-ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin \
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin:${HOME}/bin \
  NODE_PATH=/usr/local/bin:/usr/local/lib/node_modules:${PNPM_HOME}/global/5/node_modules \
  PIP_CACHE_DIR=${PYTHON_HOME}/pip \
  PYTHONPATH=${PYTHON_HOME}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}/site-packages
@@ -1,7 +1,5 @@
 #!/bin/bash

-export PATH="$HOME/bin:$PATH"
-
 dir_shell=/ql/shell
 . $dir_shell/share.sh

@@ -55,12 +55,15 @@
    }
  },
  "dependencies": {
+    "@bufbuild/protobuf": "^2.10.0",
    "@grpc/grpc-js": "^1.14.0",
    "@grpc/proto-loader": "^0.8.0",
+    "@keyv/sqlite": "^4.0.1",
    "@otplib/preset-default": "^12.0.1",
    "body-parser": "^1.20.3",
    "celebrate": "^15.0.3",
    "chokidar": "^4.0.1",
+    "compression": "^1.7.4",
    "cors": "^2.8.5",
    "cron-parser": "^5.4.0",
    "cross-spawn": "^7.0.6",
@@ -70,69 +73,66 @@
    "express-jwt": "^8.4.1",
    "express-rate-limit": "^7.4.1",
    "express-urlrewrite": "^2.0.3",
-    "undici": "^7.9.0",
+    "helmet": "^8.1.0",
    "hpagent": "^1.2.0",
    "http-proxy-middleware": "^3.0.3",
    "iconv-lite": "^0.6.3",
+    "ip2region": "2.3.0",
    "js-yaml": "^4.1.0",
    "jsonwebtoken": "^9.0.2",
+    "keyv": "^5.2.3",
    "lodash": "^4.17.21",
-    "multer": "1.4.5-lts.1",
+    "multer": "^2.1.1",
    "node-schedule": "^2.1.0",
    "nodemailer": "^6.9.16",
    "p-queue-cjs": "7.3.4",
-    "@bufbuild/protobuf": "^2.10.0",
+    "proper-lockfile": "^4.1.2",
    "ps-tree": "^1.2.0",
    "reflect-metadata": "^0.2.2",
+    "request-ip": "3.3.0",
    "sequelize": "^6.37.5",
    "sockjs": "^0.3.24",
    "sqlite3": "git+https://github.com/whyour/node-sqlite3.git#v1.0.3",
    "toad-scheduler": "^3.0.1",
    "typedi": "^0.10.0",
+    "undici": "^7.9.0",
    "uuid": "^11.0.3",
    "winston": "^3.17.0",
-    "winston-daily-rotate-file": "^5.0.0",
-    "request-ip": "3.3.0",
-    "ip2region": "2.3.0",
-    "keyv": "^5.2.3",
-    "@keyv/sqlite": "^4.0.1",
-    "proper-lockfile": "^4.1.2",
-    "compression": "^1.7.4",
-    "helmet": "^8.1.0"
+    "winston-daily-rotate-file": "^5.0.0"
  },
  "devDependencies": {
-    "moment": "2.30.1",
    "@ant-design/icons": "^5.0.1",
    "@ant-design/pro-layout": "6.38.22",
-    "@codemirror/view": "^6.34.1",
    "@codemirror/state": "^6.4.1",
+    "@codemirror/view": "^6.34.1",
    "@monaco-editor/react": "4.2.1",
    "@react-hook/resize-observer": "^2.0.2",
-    "react-router-dom": "6.26.1",
    "@types/body-parser": "^1.19.2",
+    "@types/compression": "^1.7.2",
    "@types/cors": "^2.8.12",
    "@types/cross-spawn": "^6.0.2",
    "@types/express": "^4.17.13",
    "@types/express-jwt": "^6.0.4",
    "@types/file-saver": "2.0.2",
+    "@types/helmet": "^4.0.0",
    "@types/js-yaml": "^4.0.5",
    "@types/jsonwebtoken": "^8.5.8",
    "@types/lodash": "^4.14.185",
-    "@types/multer": "^1.4.7",
+    "@types/multer": "^2.1.0",
    "@types/node": "^17.0.21",
    "@types/node-schedule": "^1.3.2",
    "@types/nodemailer": "^6.4.4",
+    "@types/proper-lockfile": "^4.1.4",
+    "@types/ps-tree": "^1.1.6",
    "@types/qrcode.react": "^1.0.2",
    "@types/react": "^18.0.20",
    "@types/react-copy-to-clipboard": "^5.0.4",
    "@types/react-dom": "^18.0.6",
+    "@types/request-ip": "0.0.41",
    "@types/serve-handler": "^6.1.1",
    "@types/sockjs": "^0.3.33",
    "@types/sockjs-client": "^1.5.1",
    "@types/uuid": "^8.3.4",
-    "@types/request-ip": "0.0.41",
-    "@types/proper-lockfile": "^4.1.4",
-    "@types/ps-tree": "^1.1.6",
    "@uiw/codemirror-extensions-langs": "^4.21.9",
    "@uiw/react-codemirror": "^4.21.9",
    "@umijs/max": "^4.4.4",
@@ -144,9 +144,9 @@
    "axios": "^1.4.0",
    "compression-webpack-plugin": "9.2.0",
    "concurrently": "^7.0.0",
-    "react-hotkeys-hook": "^4.6.1",
    "file-saver": "2.0.2",
    "lint-staged": "^13.0.3",
+    "moment": "2.30.1",
    "monaco-editor": "0.33.0",
    "nodemon": "^3.0.1",
    "prettier": "^2.5.1",
@@ -162,7 +162,9 @@
    "react-dnd": "^16.0.1",
    "react-dnd-html5-backend": "^16.0.1",
    "react-dom": "18.3.1",
+    "react-hotkeys-hook": "^4.6.1",
    "react-intl-universal": "^2.12.0",
+    "react-router-dom": "6.26.1",
    "react-split-pane": "^0.1.92",
    "sockjs-client": "^1.6.0",
    "ts-node": "^10.9.2",
@@ -170,8 +172,6 @@
    "tslib": "^2.4.0",
    "typescript": "5.2.2",
    "vh-check": "^2.0.5",
-    "virtualizedtableforantd4": "1.3.0",
-    "@types/compression": "^1.7.2",
-    "@types/helmet": "^4.0.0"
+    "virtualizedtableforantd4": "1.3.0"
  }
 }
@@ -111,76 +111,6 @@ add_cron() {
  notify_api "$path 新增任务" "$detail"
 }

-## 自动安装订阅仓库中的Python依赖
-auto_install_python_deps() {
-  local repo_path="$1"
-  local uniq_path="$2"
-  
-  echo -e "\n检测订阅仓库中的Python依赖文件...\n"
-  
-  get_token
-  
-  # 检查 requirements.txt
-  if [[ -f "${repo_path}/requirements.txt" ]]; then
-    echo -e "发现 requirements.txt，开始自动安装依赖...\n"
-    local req_file="${dir_scripts}/${uniq_path}/requirements.txt"
-    
-    # 确保目标目录存在
-    make_dir "${dir_scripts}/${uniq_path}"
-    
-    # 复制文件并检查结果
-    if cp -f "${repo_path}/requirements.txt" "${req_file}" 2>/dev/null; then
-      # 调用API添加依赖安装任务
-      local dep_name="${uniq_path}/requirements.txt"
-      local currentTimeStamp=$(date +%s)
-      local result=$(curl -s --noproxy "*" "http://127.0.0.1:${ql_port}/open/dependencies?t=$currentTimeStamp" \
-        -X POST \
-        -H "Content-Type: application/json;charset=UTF-8" \
-        -H "Authorization: Bearer ${__ql_token__}" \
-        --data-raw "[{\"name\":\"${dep_name}\",\"type\":1,\"remark\":\"自动检测：${uniq_path} 订阅依赖\"}]" 2>/dev/null)
-      
-      local code=$(echo "$result" | jq -r '.code' 2>/dev/null)
-      if [[ "$code" == "200" ]]; then
-        echo -e "已添加 requirements.txt 依赖安装任务\n"
-      else
-        echo -e "添加 requirements.txt 依赖失败，请手动添加\n"
-      fi
-    else
-      echo -e "复制 requirements.txt 失败，跳过自动安装\n"
-    fi
-  fi
-  
-  # 检查 pyproject.toml
-  if [[ -f "${repo_path}/pyproject.toml" ]]; then
-    echo -e "发现 pyproject.toml，开始自动安装依赖...\n"
-    local pyproject_file="${dir_scripts}/${uniq_path}/pyproject.toml"
-    
-    # 确保目标目录存在
-    make_dir "${dir_scripts}/${uniq_path}"
-    
-    # 复制文件并检查结果
-    if cp -f "${repo_path}/pyproject.toml" "${pyproject_file}" 2>/dev/null; then
-      # 调用API添加依赖安装任务
-      local dep_name="${uniq_path}/pyproject.toml"
-      local currentTimeStamp=$(date +%s)
-      local result=$(curl -s --noproxy "*" "http://127.0.0.1:${ql_port}/open/dependencies?t=$currentTimeStamp" \
-        -X POST \
-        -H "Content-Type: application/json;charset=UTF-8" \
-        -H "Authorization: Bearer ${__ql_token__}" \
-        --data-raw "[{\"name\":\"${dep_name}\",\"type\":1,\"remark\":\"自动检测：${uniq_path} 订阅依赖\"}]" 2>/dev/null)
-      
-      local code=$(echo "$result" | jq -r '.code' 2>/dev/null)
-      if [[ "$code" == "200" ]]; then
-        echo -e "已添加 pyproject.toml 依赖安装任务\n"
-      else
-        echo -e "添加 pyproject.toml 依赖失败，请手动添加\n"
-      fi
-    else
-      echo -e "复制 pyproject.toml 失败，跳过自动安装\n"
-    fi
-  fi
-}
-
 ## 更新仓库
 update_repo() {
  local url="$1"
@@ -207,10 +137,6 @@ update_repo() {

  if [[ $exit_status -eq 0 ]]; then
    echo -e "拉取 ${uniq_path} 成功...\n"
-    
-    # 自动检测并安装Python依赖
-    auto_install_python_deps "${repo_path}" "${uniq_path}"
-    
    diff_scripts "$repo_path" "$author" "$path" "$blackword" "$dependence" "$extensions" "$autoAddCron" "$autoDelCron"
  else
    echo -e "拉取 ${uniq_path} 失败，请检查日志...\n"
@@ -390,7 +390,11 @@
  "调用版本；专业版填写pro，个人版填写personal，为空默认使用专业版": "Version, you can specify 'pro' for the Professional version and 'personal' for the Personal version. If left blank, it will default to the Professional version.",
  "飞书群组机器人：https://www.feishu.cn/hc/zh-CN/articles/360024984973": "Feishu group bot: https://www.feishu.cn/hc/zh-CN/articles/360024984973",
  "飞书群组机器人加签密钥，安全设置中开启签名校验后获得": "Feishu group bot signature secret, obtained after enabling signature verification in security settings",
+  "邮箱服务名称，比如126、163、Gmail、QQ等，支持列表https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json，设置emailHost后此项可不填": "Email service name, e.g., 126, 163, Gmail, QQ, etc. Supported list: https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json. Can be left blank if emailHost is set",
  "邮箱服务名称，比如126、163、Gmail、QQ等，支持列表https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json": "Email service name, e.g., 126, 163, Gmail, QQ, etc. Supported list: https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json",
+  "自定义SMTP服务器地址，设置后将忽略emailService中的服务器配置，如smtp.qiye.aliyun.com": "Custom SMTP server address. When set, the server configuration in emailService will be ignored. E.g., smtp.qiye.aliyun.com",
+  "自定义SMTP端口号，默认465": "Custom SMTP port number, default is 465",
+  "是否使用SSL/TLS，端口为465时默认为true，否则默认为false": "Whether to use SSL/TLS. Defaults to true when port is 465, otherwise false",
  "邮箱地址": "Email Address",
  "SMTP 登录密码，也可能为特殊口令，视具体邮件服务商说明而定": "The SMTP login password may also be a special passphrase, depending on the specific email service provider's instructions",
  "PushMe的Key，https://push.i-i.me/": "PushMe key, https://push.i-i.me/",
@@ -390,7 +390,11 @@
  "调用版本；专业版填写pro，个人版填写personal，为空默认使用专业版": "调用版本；专业版填写pro，个人版填写personal，为空默认使用专业版",
  "飞书群组机器人：https://www.feishu.cn/hc/zh-CN/articles/360024984973": "飞书群组机器人：https://www.feishu.cn/hc/zh-CN/articles/360024984973",
  "飞书群组机器人加签密钥，安全设置中开启签名校验后获得": "飞书群组机器人加签密钥，安全设置中开启签名校验后获得",
+  "邮箱服务名称，比如126、163、Gmail、QQ等，支持列表https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json，设置emailHost后此项可不填": "邮箱服务名称，比如126、163、Gmail、QQ等，支持列表https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json，设置emailHost后此项可不填",
  "邮箱服务名称，比如126、163、Gmail、QQ等，支持列表https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json": "邮箱服务名称，比如126、163、Gmail、QQ等，支持列表https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json",
+  "自定义SMTP服务器地址，设置后将忽略emailService中的服务器配置，如smtp.qiye.aliyun.com": "自定义SMTP服务器地址，设置后将忽略emailService中的服务器配置，如smtp.qiye.aliyun.com",
+  "自定义SMTP端口号，默认465": "自定义SMTP端口号，默认465",
+  "是否使用SSL/TLS，端口为465时默认为true，否则默认为false": "是否使用SSL/TLS，端口为465时默认为true，否则默认为false",
  "邮箱地址": "邮箱地址",
  "SMTP 登录密码，也可能为特殊口令，视具体邮件服务商说明而定": "SMTP 登录密码，也可能为特殊口令，视具体邮件服务商说明而定",
  "PushMe的Key，https://push.i-i.me/": "PushMe的Key，https://push.i-i.me/",
@@ -22,9 +22,6 @@ const DependenceModal = ({
 }) => {
  const [form] = Form.useForm();
  const [loading, setLoading] = useState(false);
-  const [selectedType, setSelectedType] = useState(
-    DependenceTypes[defaultType as any],
-  );

  const handleOk = async (values: any) => {
    setLoading(true);
@@ -93,7 +90,7 @@ const DependenceModal = ({
          label={intl.get('依赖类型')}
          initialValue={DependenceTypes[defaultType as any]}
        >
-          <Select onChange={(value) => setSelectedType(value)}>
+          <Select>
            {config.dependenceTypes.map((x, i) => (
              <Option key={i} value={i}>
                {x}
@@ -124,24 +121,11 @@ const DependenceModal = ({
              whitespace: true,
            },
          ]}
-          tooltip={
-            selectedType === DependenceTypes.python3
-              ? intl.get(
-                  'Python支持多种安装方式：\n1. 包名（如：requests）\n2. GitHub链接（如：git+https://github.com/user/repo.git）\n3. requirements文件路径（如：path/to/requirements.txt）\n4. pyproject.toml文件路径',
-                )
-              : undefined
-          }
        >
          <Input.TextArea
            rows={4}
            autoSize={{ minRows: 1, maxRows: 5 }}
-            placeholder={
-              selectedType === DependenceTypes.python3
-                ? intl.get(
-                    '支持包名、GitHub链接、requirements.txt或pyproject.toml路径',
-                  )
-                : intl.get('请输入依赖名称')
-            }
+            placeholder={intl.get('请输入依赖名称')}
          />
        </Form.Item>
        <Form.Item name="remark" label={intl.get('备注')}>
@@ -406,9 +406,26 @@ export default {
      {
        label: 'emailService',
        tip: intl.get(
-          '邮箱服务名称，比如126、163、Gmail、QQ等，支持列表https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json',
+          '邮箱服务名称，比如126、163、Gmail、QQ等，支持列表https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json，设置emailHost后此项可不填',
        ),
-        required: true,
+      },
+      {
+        label: 'emailHost',
+        tip: intl.get(
+          '自定义SMTP服务器地址，设置后将忽略emailService中的服务器配置，如smtp.qiye.aliyun.com',
+        ),
+      },
+      {
+        label: 'emailPort',
+        tip: intl.get('自定义SMTP端口号，默认465'),
+      },
+      {
+        label: 'emailSecure',
+        tip: intl.get('是否使用SSL/TLS，端口为465时默认为true，否则默认为false'),
+        items: [
+          { value: 'true', label: 'true' },
+          { value: 'false', label: 'false' },
+        ],
      },
      { label: 'emailUser', tip: intl.get('邮箱认证地址'), required: true },
      {
@@ -1,11 +1,6 @@
-version: 2.20.1
-changeLogLink: https://t.me/jiao_long/433
-publishTime: 2025-12-26 22:00
+version: 2.20.2
+changeLogLink: https://t.me/jiao_long/434
+publishTime: 2026-03-01 1800
 changeLog: |
-  1. 修复获取依赖管理列表
-  2. notify.js 修复 TG_PROXY_AUTH 参数拼接
-  3. QLAPI.notify larkSecret 参数
-  4. 修复 cron parser 定时规则校验
-  5. 修复设置 baseUrl 后无法访问
-  6. 修复环境变量排序
-  7. 修复定时任务无法停止
+  1. 修复 path 安全漏洞（重要）
+
Author	SHA1	Message	Date
copilot-swe-agent[bot]	5800837ed5	Security: Upgrade multer from 1.4.5-lts.1 to 2.1.1 to fix DoS vulnerabilities Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>	2026-03-07 13:36:45 +00:00
copilot-swe-agent[bot]	aecdd7852b	Fix: Add custom SMTP host/port/secure settings to fix AliyunQiye email connection error Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>	2026-03-07 13:31:42 +00:00
copilot-swe-agent[bot]	d68c5b85bd	Initial plan	2026-03-07 13:24:51 +00:00
whyour	275d8af4e2	更新版本 v2.20.2	2026-03-01 20:35:25 +08:00
whyour	544c432f49	修复 PATH 环境变量	2026-03-01 20:35:19 +08:00
Copilot	6bec52dca1	Fix /open/user/init auth bypass allowing credential reset on initialized systems (#2941 ) * Initial plan * fix: add /open/user/init paths to init guard to prevent auth bypass Co-authored-by: whyour <22700758+whyour@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: whyour <22700758+whyour@users.noreply.github.com> Co-authored-by: whyour <imwhyour@gmail.com>	2026-03-01 18:02:21 +08:00
rockymelody	ce599d306f	青龙面板鉴权绕过漏洞已修复 (#2935 ) 已实施的安全加固措施第一层防御：启用Express严格路由（第17-18行） app.set('case sensitive routing', true); // 路由大小写敏感 app.set('strict routing', true); // 严格路由匹配第二层防御：路径标准化检查中间件（第23-37行） app.use((req, res, next) => { const originalPath = req.path; const normalizedPath = originalPath.toLowerCase(); // 检测并拦截大小写混淆攻击 if (originalPath !== normalizedPath && (normalizedPath.startsWith('/api/') \|\| normalizedPath.startsWith('/open/'))) { return res.status(400).json({ code: 400, message: 'Invalid path format' }); } next(); }); 作用：主动检测并拒绝含有大小写变体的恶意请求第三层防御：JWT中间件正则表达式修复（第59行） // 修复前： path: [...config.apiWhiteList, /^\/(?!api\/)./], // 修复后：添加大小写不敏感标志 'i' path: [...config.apiWhiteList, /^(\/(?!api\/).)$/i], 作用：防御正则匹配层面的绕过第四层防御：自定义Token中间件路径标准化（第74-87行） // 修复前： if (!['/open/', '/api/'].some((x) => req.path.startsWith(x))) { // 修复后：统一转小写比较 const pathLower = req.path.toLowerCase(); if (!['/open/', '/api/'].some((x) => pathLower.startsWith(x))) { } 作用：确保Token验证逻辑对所有路径变体生效第五层防御：初始化接口路径检查修复（第122-123行） // 修复前： if (!['/api/user/init', '/api/user/notification/init'].includes(req.path)) { // 修复后： const pathLower = req.path.toLowerCase(); if (!['/api/user/init', '/api/user/notification/init'].includes(pathLower)) {	2026-03-01 17:44:03 +08:00