new-api

History

CaIon 20399d3c8f fix: harden SSRF protection for unauthenticated and user-level endpoints

- Add ValidateURLWithFetchSetting check before fetching MJ image URLs
  in RelayMidjourneyImage (unauthenticated endpoint)
- Add ValidateURLWithFetchSetting check before fetching video URLs
  in VideoProxy (upstream-controlled URL)
- Enable ApplyIPFilterForDomain by default to prevent DNS rebinding
  bypass of SSRF protection
- Elevate FetchModels endpoint from AdminAuth to RootAuth
- Update frontend: mark domain IP filtering as recommended, update
  description and i18n translations (zh-CN/zh-TW/en/fr/ja/ru/vi)

2026-03-31 17:57:47 +08:00

discord.go

🛡️ fix: prevent OOM on large/decompressed requests; skip heavy prompt meta when token count is disabled

2025-12-16 17:00:19 +08:00

fetch_setting.go

fix: harden SSRF protection for unauthenticated and user-level endpoints

2026-03-31 17:57:47 +08:00

legal.go

format: package name -> github.com/QuantumNous/new-api (#2017 )

2025-10-11 15:30:09 +08:00

oidc.go

format: package name -> github.com/QuantumNous/new-api (#2017 )