fix: support non-root user container startup

- Guard /etc/resolv.conf write and crond behind root check in entrypoint;
  non-root containers now stay alive via 'tail -f /dev/null' instead of
  failing when crond exits with EPERM
- Set PM2_HOME to ${QL_DIR}/data/.pm2 (inside the data volume) so PM2
  does not fall back to /root/.pm2, which is inaccessible to non-root users
- Pre-create /ql/.tmp and /ql/shell/preload during image build and make
  them world-writable so non-root processes can write runtime files
- Wrap directory creation in initFile.ts with try/catch + recursive:true
  so a permission error on ~/.ssh (HOME=/root for non-root user) is logged
  as a warning instead of crashing the server init

back/app.ts

@@ -151,6 +151,8 @@ class Application {
   private setupMiddlewares() {
     this.app.use(helmet({
       contentSecurityPolicy: false,
+      crossOriginOpenerPolicy: false,
+      originAgentCluster: false,
     }));
     this.app.use(cors(config.cors));
     this.app.use(compression());

back/loaders/express.ts

@@ -13,9 +13,29 @@ import { isValidToken } from '../shared/auth';
 import path from 'path';
 
 export default ({ app }: { app: Application }) => {
+  // Security: Enable strict routing to prevent case-insensitive path bypass
+  app.set('case sensitive routing', true);
+  app.set('strict routing', true);
   app.set('trust proxy', 'loopback');
   app.use(cors());
   
+  // Security: Path normalization middleware to prevent case variation attacks
+  app.use((req, res, next) => {
+    const originalPath = req.path;
+    const normalizedPath = originalPath.toLowerCase();
+    
+    // Block requests with case variations on protected paths
+    if (originalPath !== normalizedPath && 
+        (normalizedPath.startsWith('/api/') || normalizedPath.startsWith('/open/'))) {
+      return res.status(400).json({
+        code: 400,
+        message: 'Invalid path format'
+      });
+    }
+    
+    next();
+  });
+  
   // Rewrite URLs to strip baseUrl prefix if configured
   // This allows the rest of the app to work without baseUrl awareness
   if (config.baseUrl) {
@@ -36,7 +56,7 @@ export default ({ app }: { app: Application }) => {
       secret: config.jwt.secret,
       algorithms: ['HS384'],
     }).unless({
-      path: [...config.apiWhiteList, /^\/(?!api\/).*/],
+      path: [...config.apiWhiteList, /^(\/(?!api\/).*)$/i],
     }),
   );
 
@@ -51,19 +71,20 @@ export default ({ app }: { app: Application }) => {
   });
 
   app.use(async (req: Request, res, next) => {
-    if (!['/open/', '/api/'].some((x) => req.path.startsWith(x))) {
+    const pathLower = req.path.toLowerCase();
+    if (!['/open/', '/api/'].some((x) => pathLower.startsWith(x))) {
       return next();
     }
 
     const headerToken = getToken(req);
-    if (req.path.startsWith('/open/')) {
+    if (pathLower.startsWith('/open/')) {
       const apps = await shareStore.getApps();
       const doc = apps?.filter((x) =>
         x.tokens?.find((y) => y.value === headerToken),
       )?.[0];
       if (doc && doc.tokens && doc.tokens.length > 0) {
         const currentToken = doc.tokens.find((x) => x.value === headerToken);
-        const keyMatch = req.path.match(/\/open\/([a-z]+)\/*/);
+        const keyMatch = pathLower.match(/\/open\/([a-z]+)\/*/);
         const key = keyMatch && keyMatch[1];
         if (
           doc.scopes.includes(key as any) &&
@@ -98,7 +119,15 @@ export default ({ app }: { app: Application }) => {
   });
 
   app.use(async (req, res, next) => {
-    if (!['/api/user/init', '/api/user/notification/init'].includes(req.path)) {
+    const pathLower = req.path.toLowerCase();
+    if (
+      ![
+        '/api/user/init',
+        '/api/user/notification/init',
+        '/open/user/init',
+        '/open/user/notification/init',
+      ].includes(req.path)
+    ) {
       return next();
     }
     const authInfo =

back/loaders/initData.ts

@@ -13,7 +13,7 @@ import { AuthDataType, SystemModel } from '../data/system';
 import SystemService from '../services/system';
 import UserService from '../services/user';
 import { writeFile, readFile } from 'fs/promises';
-import { createRandomString, fileExist, safeJSONParse } from '../config/util';
+import { createRandomString, fileExist, isDemoEnv, safeJSONParse } from '../config/util';
 import OpenService from '../services/open';
 import { shareStore } from '../shared/store';
 import Logger from './logger';
@@ -50,7 +50,7 @@ export default async () => {
   const [authConfig] = await SystemModel.findOrCreate({
     where: { type: AuthDataType.authConfig },
   });
-  if (!authConfig?.info) {
+  if (!authConfig?.info || isDemoEnv()) {
     let authInfo = {
       username: 'admin',
       password: 'admin',

back/loaders/initFile.ts

@@ -104,7 +104,11 @@ const files = [
 export default async () => {
   for (const dirPath of directories) {
     if (!(await fileExist(dirPath))) {
-      await fs.mkdir(dirPath);
+      try {
+        await fs.mkdir(dirPath, { recursive: true });
+      } catch (err: any) {
+        Logger.warn(`Unable to create directory ${dirPath}: ${err.message}`);
+      }
     }
   }
 

docker/310.Dockerfile

@@ -65,13 +65,17 @@ RUN git clone --depth=1 -b ${QL_BRANCH} ${QL_URL} ${QL_DIR} \
   && git clone --depth=1 -b ${QL_BRANCH} https://github.com/${QL_MAINTAINER}/qinglong-static.git /static \
   && mkdir -p ${QL_DIR}/static \
   && cp -rf /static/* ${QL_DIR}/static \
-  && rm -rf /static
+  && rm -rf /static \
+  && mkdir -p ${QL_DIR}/.tmp ${QL_DIR}/shell/preload \
+  && chmod -R a+w ${QL_DIR}/.tmp ${QL_DIR}/shell/preload ${QL_DIR}/static
 
 ENV PNPM_HOME=${QL_DIR}/data/dep_cache/node \
   PYTHON_HOME=${QL_DIR}/data/dep_cache/python3 \
-  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3
+  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3 \
+  PM2_HOME=${QL_DIR}/data/.pm2 \
+  HOME=/root
 
-ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin \
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin:${HOME}/bin \
   NODE_PATH=/usr/local/bin:/usr/local/lib/node_modules:${PNPM_HOME}/global/5/node_modules \
   PIP_CACHE_DIR=${PYTHON_HOME}/pip \
   PYTHONPATH=${PYTHON_HOME}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}/site-packages
@@ -83,6 +87,6 @@ COPY --from=builder /tmp/build/node_modules/. /ql/node_modules/
 WORKDIR ${QL_DIR}
 
 HEALTHCHECK --interval=5s --timeout=2s --retries=20 \
-  CMD curl -sf --noproxy '*' http://127.0.0.1:5700/api/health || exit 1
+  CMD curl -sf --noproxy '*' http://127.0.0.1:${QlPort:-5700}/api/health || exit 1
 
 ENTRYPOINT ["./docker/docker-entrypoint.sh"]

docker/Dockerfile

@@ -65,13 +65,17 @@ RUN git clone --depth=1 -b ${QL_BRANCH} ${QL_URL} ${QL_DIR} \
   && git clone --depth=1 -b ${QL_BRANCH} https://github.com/${QL_MAINTAINER}/qinglong-static.git /static \
   && mkdir -p ${QL_DIR}/static \
   && cp -rf /static/* ${QL_DIR}/static \
-  && rm -rf /static
+  && rm -rf /static \
+  && mkdir -p ${QL_DIR}/.tmp ${QL_DIR}/shell/preload \
+  && chmod -R a+w ${QL_DIR}/.tmp ${QL_DIR}/shell/preload ${QL_DIR}/static
 
 ENV PNPM_HOME=${QL_DIR}/data/dep_cache/node \
   PYTHON_HOME=${QL_DIR}/data/dep_cache/python3 \
-  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3
+  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3 \
+  PM2_HOME=${QL_DIR}/data/.pm2 \
+  HOME=/root
 
-ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin \
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin:${HOME}/bin \
   NODE_PATH=/usr/local/bin:/usr/local/lib/node_modules:${PNPM_HOME}/global/5/node_modules \
   PIP_CACHE_DIR=${PYTHON_HOME}/pip \
   PYTHONPATH=${PYTHON_HOME}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}/site-packages
@@ -83,6 +87,6 @@ COPY --from=builder /tmp/build/node_modules/. /ql/node_modules/
 WORKDIR ${QL_DIR}
 
 HEALTHCHECK --interval=5s --timeout=2s --retries=20 \
-  CMD curl -sf --noproxy '*' http://127.0.0.1:5700/api/health || exit 1
+  CMD curl -sf --noproxy '*' http://127.0.0.1:${QlPort:-5700}/api/health || exit 1
 
 ENTRYPOINT ["./docker/docker-entrypoint.sh"]

docker/docker-entrypoint.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
 
-export PATH="$HOME/bin:$PATH"
-
 dir_shell=/ql/shell
 . $dir_shell/share.sh
 
@@ -17,10 +15,10 @@ log_with_style() {
   printf "\n[%s] [%7s]  %s\n" "${timestamp}" "${level}" "${message}"
 }
 
-# Fix DNS resolution issues in Alpine Linux
+# Fix DNS resolution issues in Alpine Linux (requires root)
 # Alpine uses musl libc which has known DNS resolver issues with certain domains
 # Adding ndots:0 prevents unnecessary search domain appending
-if [ -f /etc/alpine-release ]; then
+if [ "$(id -u)" = "0" ] && [ -f /etc/alpine-release ]; then
   if ! grep -q "^options ndots:0" /etc/resolv.conf 2>/dev/null; then
     echo "options ndots:0" >> /etc/resolv.conf
     log_with_style "INFO" "🔧  0. 已配置 DNS 解析优化 (ndots:0)"
@@ -52,6 +50,11 @@ fi
 
 log_with_style "SUCCESS" "🎉  容器启动成功!"
 
-crond -f >/dev/null
+if [ "$(id -u)" = "0" ]; then
+  crond -f >/dev/null
+else
+  # crond requires root in Alpine; keep container alive without it
+  exec tail -f /dev/null
+fi
 
 exec "$@"

package.json

@@ -77,9 +77,9 @@
     "js-yaml": "^4.1.0",
     "jsonwebtoken": "^9.0.2",
     "lodash": "^4.17.21",
-    "multer": "1.4.5-lts.1",
+    "multer": "2.1.1",
     "node-schedule": "^2.1.0",
-    "nodemailer": "^6.9.16",
+    "nodemailer": "^8.0.1",
     "p-queue-cjs": "7.3.4",
     "@bufbuild/protobuf": "^2.10.0",
     "ps-tree": "^1.2.0",

version.yaml

@@ -1,11 +1,6 @@
-version: 2.20.1
-changeLogLink: https://t.me/jiao_long/433
-publishTime: 2025-12-26 22:00
+version: 2.20.2
+changeLogLink: https://t.me/jiao_long/434
+publishTime: 2026-03-01 1800
 changeLog: |
-  1. 修复获取依赖管理列表
-  2. notify.js 修复 TG_PROXY_AUTH 参数拼接
-  3. QLAPI.notify larkSecret 参数
-  4. 修复 cron parser 定时规则校验
-  5. 修复设置 baseUrl 后无法访问
-  6. 修复环境变量排序
-  7. 修复定时任务无法停止
+  1. 修复 path 安全漏洞（重要）
+