tools/WechatOnCloud
1
0
Fork 0
mirror of https://github.com/Gloridust/WechatOnCloud.git synced 2026-06-16 19:53:53 +08:00
Code Issues Packages Projects Releases Wiki Activity
33 Commits 2 Branches 18 Tags
2ae4b6932d1ace350e93f04e5cffe91db5b55553
Commit Graph

33 Commits

This Branch
This Branch
All Branches
  • Update README.md
    Gloridust · 2026-06-06 02:21:52 +08:00
    2ae4b6932d
  • docs: add社媒 links (Twitter / Telegram) to README 
    Hero badges + a 交流与关注 section: x.com/gloridust1024, t.me/WechatOnCloud.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
    Gloridust · 2026-06-06 02:19:09 +08:00
    5b3abd0583
  • fix: machine mask
    Gloridust · 2026-06-06 02:15:16 +08:00
    v1.1.7 27fa9c2670
  • fix(P0): unique persistent machine-id per instance + manual reset 
    All instances shared the image-baked machine-id (a67bf09f...), so Tencent
saw every WechatOnCloud account worldwide as one "device" — a textbook
device-farm signal triggering risk control and the forced-logout loop
reported across old and new versions.

- docker/woc-identity.sh: new /custom-cont-init.d/00-woc-identity hook —
  generates a unique machine-id on first start, persists it in the data
  volume (survives restart/upgrade/recreate), writes /etc/machine-id +
  /var/lib/dbus/machine-id, removes /.dockerenv. Existing instances get a
  fresh unique id on first upgraded start (volume lacks the file).
- regenInstanceMachineId + POST /api/admin/instances/:id/regen-machine-id:
  roll a brand-new device id and restart, for accounts re-flagged by risk
  control. Gated on the hook being present (old image → instructs upgrade).
- Admin 实例卡片「安全」弹窗新增「重置设备 ID 并重启」。

Verified: two fresh containers get distinct machine-ids; id persists across
restart; regen (rm persisted file + restart) yields a new persistent id.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
    Gloridust · 2026-06-06 01:41:45 +08:00
    v1.1.6 8fd147bccc
  • ci: optional Docker Hub mirror in release workflow 
    - release.yml: dual-push to GHCR + Docker Hub when vars.DOCKERHUB_USERNAME
  is set; falls back to GHCR-only when unset (no behavior change for forks).
- .env.example: surface docker.io as a first-class WOC_IMAGE_PREFIX option.
- doc/发布到GHCR.md: document the one-time Variable + Secret setup and the
  prerequisite of pre-creating the public repos on hub.docker.com.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
    Gloridust · 2026-06-04 18:18:21 +08:00
    c37588617e
  • docs(security): clarify multi-host allowlist + echo rejected host in 400 
    - .env.example: surface multi-domain syntax (PANEL_ALLOWED_HOSTS=a,b,c),
  IPv6 literal example, and reverse-proxy troubleshooting tip.
- index.ts: 400 response includes the rejected `host` and a hint pointing
  at PANEL_ALLOWED_HOSTS — drops the diagnostic floor when reverse-proxy
  Host-passthrough is misconfigured.

Follow-up to #13 (DNS-rebinding allowlist).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
    Gloridust · 2026-06-04 17:55:46 +08:00
    v1.1.5 35f256edb8
  • Merge pull request #13 from aaronjmars/security/host-allowlist-dns-rebinding 
    fix(security): gate panel Host header to block DNS rebinding
    Ethan Zou · 2026-06-04 17:53:46 +08:00
    a2677c6b4a
  • feat: delet old docker
    Gloridust · 2026-06-04 17:42:06 +08:00
    v1.1.4 ba8fe96486
  • fix ram
    Gloridust · 2026-06-04 17:33:00 +08:00
    d99c3b8bf6
  • fix(security): gate panel Host header to block DNS rebinding 
    Without Host validation, a malicious page the operator visits can use DNS
rebinding to point a hostname at the panel's loopback / LAN IP and drive
every authenticated API from the operator's own browser — including the
docker.sock-backed admin endpoints. The README's "intranet-only" guidance
does not cover this: the browser is the trust-boundary crossing.

Add an onRequest hook (plus a Host check on raw WebSocket upgrades) that
allows loopback + RFC1918 LAN by default and accepts public hostnames via
PANEL_ALLOWED_HOSTS (documented in .env.example and threaded through
docker-compose.yml). 35 inject()-driven assertions; tsc --noEmit clean.

Detected by Aeon + manual review (DNS-rebinding-gate axis).
Severity: high
CWE-346 (Origin Validation Error)
    aeonframework · 2026-06-02 20:25:28 +00:00
    74c436e779
  • Merge pull request #12 from huglemon/fix/cjk-ime-paste-fallback 
    修复中文 IME 输入大量丢字：增加容器内剪贴板粘贴兜底路径
    Ethan Zou · 2026-06-03 01:16:40 +08:00
    v1.1.3 9da876502c
  • fix: add CJK IME paste fallback
    huglemon · 2026-06-03 00:08:47 +08:00
    6df7d8c7cf
  • Update README.md
    Gloridust · 2026-06-02 23:14:16 +08:00
    fb46aca2d9
  • uodate doc
    Gloridust · 2026-06-02 20:15:16 +08:00
    edf8c349c6
  • fix:new docker no found
    Gloridust · 2026-06-02 20:03:57 +08:00
    b2521a8627
  • fix Chinese input & copyboard & log
    Gloridust · 2026-06-02 19:46:28 +08:00
    v1.1.2 4f582f2c5e
  • Update README.md
    Gloridust · 2026-06-02 19:29:51 +08:00
    5d7ad4ed8a
  • Update README.md
    Gloridust · 2026-06-02 19:27:58 +08:00
    bbaf3e673d
  • 更新 README.md
    Ethan Zou · 2026-06-02 15:54:40 +08:00
    04952118db
  • update doc
    Gloridust · 2026-06-02 14:31:37 +08:00
    58a746d4cb
  • Update README.md
    Ethan Zou · 2026-06-02 09:34:16 +08:00
    b7f46eeb14
  • fix autostart
    Gloridust · 2026-06-01 19:42:35 +08:00
    v1.1.1 49b785ff9f
  • update ui and fix vnc v1.1.0
    Gloridust · 2026-06-01 17:31:57 +08:00
    v1.1.0 1555e60072
  • Update README.md
    Gloridust · 2026-05-31 13:39:09 +08:00
    70f42c649a
  • feat: 超管密码离线找回 + 改密/重置二次确认 + GHCR 手动构建文档 
    - 密码找回：accounts.json 给用户加 "resetPassword": true（兼容 reset_password），
  重启面板即把其密码重置为 PANEL_ADMIN_PASSWORD（默认 wechat）、解禁并清除标记
- 改密/重置密码弹窗新增「再次输入新密码」二次确认：两次不一致则拦截，
  避免浏览器自动填充/手误把密码静默设成非预期值导致锁死
- README：补充方式 B（本机 buildx 手动多架构构建推送 GHCR）+ Release 的 latest 注意事项
  + 「重置超管密码（离线找回）」操作步骤

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
    Gloridust · 2026-05-31 13:29:54 +08:00
    v1.0.3 eddc35ecae
  • update admin UI
    Gloridust · 2026-05-31 13:07:48 +08:00
    f0e3f978d0
  • update svg
    Gloridust · 2026-05-31 12:50:07 +08:00
    d581a49a90
  • feat: 音视频/文件传输 + 产品 UX 改进 + 镜像源可切换 
    媒体链路（生产 HTTPS 下可用，含降级）
- 音频(听)：PulseAudio + KasmVNC 工具条，开箱即用
- 麦克风(说)：virtmic 管道源已就绪，运行时需 HTTPS（非 HTTPS 前端提示）
- 摄像头(视频)：docker.ts 条件化 v4l2 设备直通 + 加 video 组；无设备/无 HTTPS 时优雅降级，音频麦克风不受影响
- WOC_VIDEO_DEVICES 显式指定或经 /host-dev 自动探测

文件传输（原生拖拽）
- 面板侧拖拽上传 + 下载：dockerode putArchive/getArchive 到实例 ~/Desktop（持久卷）
- 纯 JS 单文件 tar 编解码（免依赖），文本/二进制均无损；全程走面板鉴权与权限校验

安全 & UX
- 默认密码告警条 + mustChangePassword 追踪（兼容旧账号文件迁移）
- 会话过期(401) 自动跳登录；桌面连接 loading 态
- 停止/未创建实例一键启动（新增 /api/admin/instances/:id/start）
- 统一牛奶布艺弹窗 + Toast，替换 Admin 原生 alert/confirm/prompt
- 密码可见切换；实例重命名；退出二次确认；空状态改用品牌终端图标

其它
- gen-icons 生成终端风格图标（此前仅空白绿块，影响 Docker/CI 产物）
- 镜像源可切换 WOC_IMAGE_PREFIX（国内反代/ACR）；品牌名「云微」
- 文档：.env.example / docker-compose 增加音视频(v4l2loopback/HTTPS)、镜像源、视频设备说明

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
    Gloridust · 2026-05-31 10:56:33 +08:00
    v1.0.2 v1.0.1 17ba168764
  • update proxy
    Gloridust · 2026-05-29 23:54:35 +08:00
    c6e3fad396
  • 品牌更名为「云微」并替换为终端风格图标 
    - 面板/PWA/iOS/fnOS 显示名统一改为「云微」（英文项目名 WechatOnCloud 保留）
- favicon 改为绿底 macOS 终端风格（>_ 提示符），重新编译 180/192/512 PNG
- 登录页 logo 复用同款终端图标

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
    Gloridust · 2026-05-29 22:43:07 +08:00
    v1.0.0 484d625d69
  • update
    Gloridust · 2026-05-29 22:00:23 +08:00
    5c5e9c8540
  • init
    Gloridust · 2026-05-29 15:26:59 +08:00
    81a50313c3
  • Initial commit
    Gloridust · 2026-05-29 14:14:09 +08:00
    8632009f31