修改安全策略

.dockerignore

@@ -11,6 +11,9 @@ memos
 .dockerignore
 docs/
 .DS_Store
-memos_prod.db
-memos_prod.db-shm
-memos_prod.db-wal
+/memos_prod.db
+/memos_prod.db-shm
+/memos_prod.db-wal
+/assets/
+/.thumbnail_cache/
+/.motion_cache/

.gitignore

@@ -32,7 +32,10 @@ dist
 # Frontend test coverage output (Vitest + @vitest/coverage-v8).
 web/coverage/
 
-# Database
-memos_prod.db
-memos_prod.db-shm
-memos_prod.db-wal
+# Dev
+/memos_prod.db
+/memos_prod.db-shm
+/memos_prod.db-wal
+/assets/
+/.thumbnail_cache/
+/.motion_cache/

README.md

@@ -2,6 +2,10 @@
 
 > 基于原作者v0.29.1代码修改
 
+#### v0.29.1-4
+1. 修复缓存图片无法删除
+2. 修改安全策略避免视频无法播放
+
 #### v0.29.1-3
 1. 修改设置页面commit基础链接
 2. 优化图标样式、备忘录菜单跳转

server/router/fileserver/fileserver.go

@@ -451,7 +451,7 @@ func (s *FileServerService) getThumbnailPath(attachment *store.Attachment) (stri
 	if err := os.MkdirAll(cacheFolder, os.ModePerm); err != nil {
 		return "", errors.Wrap(err, "failed to create thumbnail cache folder")
 	}
-	filename := fmt.Sprintf("%s.v2.jpeg", attachment.UID)
+	filename := fmt.Sprintf("%s.jpeg", attachment.UID)
 	return filepath.Join(cacheFolder, filename), nil
 }
 
@@ -743,7 +743,7 @@ func setSecurityHeaders(c *echo.Context) {
 	h := c.Response().Header()
 	h.Set("X-Content-Type-Options", "nosniff")
 	h.Set("X-Frame-Options", "DENY")
-	h.Set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline';")
+	h.Set("Content-Security-Policy", "default-src 'self'; style-src 'unsafe-inline';")
 }
 
 // setMediaHeaders sets headers for media file responses.

server/router/fileserver/fileserver_test.go

@@ -282,7 +282,7 @@ func TestServeAttachmentFile_SVGThumbnailServedAsImageWithSecurityHeaders(t *tes
 	require.Equal(t, "image/svg+xml", rec.Header().Get("Content-Type"))
 	require.Empty(t, rec.Header().Get("Content-Disposition"))
 	require.Equal(t, "nosniff", rec.Header().Get("X-Content-Type-Options"))
-	require.Equal(t, "default-src 'none'; style-src 'unsafe-inline';", rec.Header().Get("Content-Security-Policy"))
+	require.Equal(t, "default-src 'self'; style-src 'unsafe-inline';", rec.Header().Get("Content-Security-Policy"))
 	require.Equal(t, svgContent, rec.Body.Bytes())
 }