webtun 1.5.4 → 1.5.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +10 -4
- package/package.json +1 -1
- package/public/index.html +740 -122
- package/server.js +27 -9
package/README.md
CHANGED
|
@@ -69,17 +69,16 @@ git clone https://github.com/unn-Known1/webtun.git && cd webtun && ./setup.sh &&
|
|
|
69
69
|
- **Bracketed paste** — Ctrl+V works in TUI apps (vim, nano, htop) — 60KB chunked
|
|
70
70
|
- **Command history** — keystroke-based capture, strips ANSI/control sequences
|
|
71
71
|
- **Session persistence** — tmux or in-memory PTY; tabs survive page reload (all platforms)
|
|
72
|
-
- **Fullscreen** — terminal fullscreen `Shift+F11` (header button), fits and refocuses
|
|
73
72
|
- **Keyboard Shortcuts** — reference dialog in the overflow menu (Ctrl+P/T/W/B/F, etc.)
|
|
74
73
|
|
|
75
74
|
### File Explorer
|
|
76
|
-
- Browse, upload, download, rename, delete files
|
|
75
|
+
- Browse, upload, download, rename, delete files — **full filesystem access** (`ALLOW_FULL_FS=true` by default)
|
|
77
76
|
- **Multi-select** — batch delete, download, zip, cut, copy
|
|
78
77
|
- **Zip/Extract** — right-click any file or folder
|
|
79
78
|
- **Image viewer** — preview inline (png, jpg, gif, svg, webp)
|
|
80
79
|
- **Conflict resolution** — replace, merge, keep both, skip
|
|
81
80
|
- **Breadcrumb navigation** — tappable segments, folder icon + path one line, `2px` tight spacing, header/breadcrumb unified `30px` bar
|
|
82
|
-
- **Editor** — CodeMirror with autosave draft, `F11` fullscreen
|
|
81
|
+
- **Editor** — CodeMirror with autosave draft, `F11` fullscreen (covers terminal area only, never the file explorer), `horizontal/vertical` split toggle, markdown/HTML preview
|
|
83
82
|
|
|
84
83
|
### Mobile
|
|
85
84
|
- **Touch gestures** — swipe to close tabs, pull-to-refresh
|
|
@@ -135,7 +134,7 @@ git clone https://github.com/unn-Known1/webtun.git && cd webtun && ./setup.sh &&
|
|
|
135
134
|
| `PIN` | Auth PIN (empty = no auth) | none |
|
|
136
135
|
| `SHELL` | Shell to use | platform default |
|
|
137
136
|
| `WORKSPACE_ROOT` | File explorer root | `~` |
|
|
138
|
-
| `ALLOW_FULL_FS` | Allow browsing outside `WORKSPACE_ROOT` (full FS) | `
|
|
137
|
+
| `ALLOW_FULL_FS` | Allow browsing outside `WORKSPACE_ROOT` (full FS) | `true` |
|
|
139
138
|
| `TRUST_PROXY` | Trust `X-Forwarded-For` from first proxy | `false` |
|
|
140
139
|
| `WEBTUN_SHELL` | Override shell on Windows | PowerShell |
|
|
141
140
|
|
|
@@ -178,6 +177,13 @@ git clone https://github.com/unn-Known1/webtun.git && cd webtun && ./setup.sh &&
|
|
|
178
177
|
|
|
179
178
|
## Changelog
|
|
180
179
|
|
|
180
|
+
### v1.5.5
|
|
181
|
+
- Explorer: full filesystem access by default (`ALLOW_FULL_FS=true` unless `ALLOW_FULL_FS=false`), symlink dirs now navigable (`stat` `isDirectory`), fixed silent `403` bounce on `..` (now `toast` + error div), `parent` hidden at workspace root, `history`/`breadcrumb` desync fixed (deferred to success), stale closures on reused file items fixed (`dataset` live), drag overlay stuck fixed (`relatedTarget`/`dragend`/`blur`), relative `path-input` now `joinPath(currentPath)`, `rename` dialog no longer closes on error
|
|
182
|
+
- Settings: drawer flicker fixed (`#main:isolation`, `#sidebar`/`#settings-panel` `will-change`/`backface-visibility`, `#file-list-wrap` `content-visibility` removed, `inert`/`focusTrap` deferred via `rAF` + `preventScroll`, `fileWatcher` skips when drawer/overlay open)
|
|
183
|
+
- Editor: `F11` fullscreen now `absolute` inside terminal area only (`#editor-split-area` `relative`), never covers file explorer/sidebar or header, removed `requestFullscreen` browser overlay, `CodeMirror` height `100%`
|
|
184
|
+
- Terminal: removed `Shift+F11` fullscreen button and `#terminals.fullscreen`/`#content.terminal-fullscreen` per request
|
|
185
|
+
- UI: `#conn-status` `margin-left:6px` before dot
|
|
186
|
+
|
|
181
187
|
### v1.5.4
|
|
182
188
|
- Security hardening: path sandbox `ALLOW_FULL_FS` (default `~`), symlink containment, null-byte/array guards, `rename` traversal block, `delete` uses `lstat`, batch caps 100, zip 1GB/unzip bomb guards, `download` header sanitization, `image` no-store, `write` 10MB cap, tunnel SSRF (localhost-only) + URL validation
|
|
183
189
|
- Auth & transport: `checkPin` array guard, length-leak free `constantTimeEqual`, rate limiter uses `req.ip` with `trust proxy` + Map cap 10k, `--pin` arg consumption fix, WS `cols/rows` clamp 2-500, Origin check + `constantTimeEqual` token, `sessionId` length 1-64, per-IP `clipboard`, `history` max 1k & `cmdhist.json` 0600 atomic writes, `ptySessions` TTL 30m + cap 100, `TMUX_PREFIX=wt-webtun-`
|