CaIon 20399d3c8f fix: harden SSRF protection for unauthenticated and user-level endpoints ...

- Add ValidateURLWithFetchSetting check before fetching MJ image URLs
  in RelayMidjourneyImage (unauthenticated endpoint)
- Add ValidateURLWithFetchSetting check before fetching video URLs
  in VideoProxy (upstream-controlled URL)
- Enable ApplyIPFilterForDomain by default to prevent DNS rebinding
  bypass of SSRF protection
- Elevate FetchModels endpoint from AdminAuth to RootAuth
- Update frontend: mark domain IP filtering as recommended, update
  description and i18n translations (zh-CN/zh-TW/en/fr/ja/ru/vi)

2026-03-31 17:57:47 +08:00

..

billing.go

refactor(error): replace dto.OpenAIError with types.OpenAIError for consistency

2025-12-13 16:43:57 +08:00

channel_affinity_cache.go

fix: channel affinity (#2799)

2026-02-02 14:37:31 +08:00

channel_upstream_update_test.go

feat: support regex-prefixed ignored upstream models

2026-03-22 15:43:03 +08:00

channel_upstream_update.go

feat: support regex-prefixed ignored upstream models

2026-03-22 15:43:03 +08:00

channel-billing.go

format: package name -> github.com/QuantumNous/new-api (#2017)

2025-10-11 15:30:09 +08:00

channel-test.go

fix: preserve explicit zero values in native relay requests

2026-03-01 15:47:03 +08:00

channel.go

fix: fetch model add header passthrough rule key check

2026-03-05 17:49:36 +08:00

checkin.go

feat(checkin): add check-in functionality with status retrieval and user quota rewards

2026-01-02 23:00:33 +08:00

codex_oauth.go

feat: codex oauth proxy

2026-02-17 18:00:10 +08:00

codex_usage.go

feat: codex oauth proxy

2026-02-17 18:00:10 +08:00

console_migrate.go

feat(file): unify file handling with a new FileSource abstraction for URL and base64 data

2026-02-04 18:23:17 +08:00

custom_oauth.go

feat: move user bindings to dedicated management modal

2026-02-23 14:51:55 +08:00

deployment.go

fix: fix model deployment style issues, lint problems, and i18n gaps. (#2556)

2026-01-03 12:37:50 +08:00

group.go

refactor(group): update user group handling to utilize userUsableGroups directly and add GetUserGroupRatio function

2025-10-30 21:16:42 +08:00

image.go

feat: support dify upload image file

2025-03-15 19:10:12 +08:00

log.go

refactor: enhance API security with read-only token authentication and improved rate limiting

2026-02-06 21:26:26 +08:00

midjourney.go

refactor: clean up unused code and improve error logging in adaptor and mjp modules

2026-02-22 22:11:05 +08:00

misc.go

imporve oauth provider UI/UX (#2983)

2026-02-22 15:41:29 +08:00

missing_models.go

format: package name -> github.com/QuantumNous/new-api (#2017)

2025-10-11 15:30:09 +08:00

model_meta.go

format: package name -> github.com/QuantumNous/new-api (#2017)

2025-10-11 15:30:09 +08:00

model_sync.go

feat(localization): added zh_TW (#2913)

2026-02-11 20:37:53 +08:00

model.go

refactor(error): replace dto.OpenAIError with types.OpenAIError for consistency

2025-12-13 16:43:57 +08:00

oauth.go

fix: oauth bind callback handling

2026-03-23 00:48:55 +08:00

option.go

fix: update language settings and improve model pricing editor for better clarity and functionality

2026-03-06 21:36:51 +08:00

passkey.go

enhance channel key viewing

2026-03-15 00:23:13 +08:00

performance.go

fix: log management race condition, partial delete reporting, and UX issues

2026-03-21 20:40:39 +08:00

playground.go

refactor(channel_select): enhance retry logic and context key usage for channel selection

2025-12-13 16:43:38 +08:00

prefill_group.go

format: package name -> github.com/QuantumNous/new-api (#2017)

2025-10-11 15:30:09 +08:00

pricing.go

feat: Improve backend multilingual support

2026-02-12 14:29:56 +08:00

ratio_config.go

format: package name -> github.com/QuantumNous/new-api (#2017)

2025-10-11 15:30:09 +08:00

ratio_sync.go

feat: add models.dev preset support to upstream ratio sync

2026-02-20 12:28:26 +08:00

redemption.go

feat(i18n): add backend multi-language support with user language preference

2026-02-05 00:09:32 +08:00

relay.go

fix(relay): skip retries for bad response body errors

2026-03-06 18:22:25 +08:00

secure_verification.go

enhance channel key viewing

2026-03-15 00:23:13 +08:00

setup.go

format: package name -> github.com/QuantumNous/new-api (#2017)

2025-10-11 15:30:09 +08:00

subscription_payment_creem.go

✨ feat: add subscription billing system (#2808)

2026-02-03 17:40:43 +08:00

subscription_payment_epay.go

fix: redirect subscription payment return to user-accessible page

2026-02-28 15:14:08 +08:00

subscription_payment_stripe.go

✨ feat: add subscription billing system (#2808)

2026-02-03 17:40:43 +08:00

subscription.go

feat(subscription): validate price amount and migrate database column type

2026-02-03 18:58:28 +08:00

swag_video.go

feat: channel kling support New API

2025-07-21 21:38:53 +08:00

task.go

feat(task): add model redirection, per-call billing, and multipart retry fix for async tasks

2026-02-22 16:33:00 +08:00

telegram.go

format: package name -> github.com/QuantumNous/new-api (#2017)

2025-10-11 15:30:09 +08:00

token_test.go

feat: implement token key fetching and masking in API responses

2026-03-08 22:40:40 +08:00

token.go

feat: implement token key fetching and masking in API responses

2026-03-08 22:40:40 +08:00

topup_creem.go

✨ feat: add subscription billing system (#2808)

2026-02-03 17:40:43 +08:00

topup_stripe.go

✨ feat: add subscription billing system (#2808)

2026-02-03 17:40:43 +08:00

topup_waffo.go

fix(waffo): remove dead gatewayOrderId code that never persisted

2026-03-18 15:57:56 +08:00

topup.go

feat(waffo): Waffo payment gateway integration with configurable methods

2026-03-17 18:04:58 +08:00

twofa.go

format: package name -> github.com/QuantumNous/new-api (#2017)

2025-10-11 15:30:09 +08:00

uptime_kuma.go

format: package name -> github.com/QuantumNous/new-api (#2017)

2025-10-11 15:30:09 +08:00

usedata.go

format: package name -> github.com/QuantumNous/new-api (#2017)

2025-10-11 15:30:09 +08:00

user.go

feat: auto fetch upstream models (#2979)

2026-03-02 22:01:53 +08:00

vendor_meta.go

format: package name -> github.com/QuantumNous/new-api (#2017)

2025-10-11 15:30:09 +08:00

video_proxy_gemini.go

fix: vertex ai video proxy and task polling improvements

2026-02-27 18:47:47 +08:00

video_proxy.go

fix: harden SSRF protection for unauthenticated and user-level endpoints

2026-03-31 17:57:47 +08:00

wechat.go

format: package name -> github.com/QuantumNous/new-api (#2017)

2025-10-11 15:30:09 +08:00