Nick Craig-Wood 3760671b36 pcloud: only accept pCloud hosts from the hostname in the OAuth callback ...

When pCloud redirects the browser back to rclone's local OAuth
callback server it adds a `hostname` parameter saying which regional
API host (api.pcloud.com or eapi.pcloud.com) the account lives on.
rclone used this for the token exchange and saved it in the config as
the host for all of the remote's later traffic, without checking it.

This only accepts a well formed hostname within pCloud's own domain,
lower cased, failing the config with an error otherwise, and adds a
unit test for the check. This is defence in depth for GHSA-hvpr-p4pv-4f46

2026-10-08 22:49:33 +01:00

..

alias

config: make getting config values more consistent

2024-08-08 13:41:31 +01:00

all

Add new backend dosya for dosya.dev cloud storage

2026-10-07 12:16:42 +01:00

archive

archive: read symlinks stored in zip and squashfs archives

2026-10-08 14:15:46 +01:00

azureblob

azureblob: fix listing a file as a directory on hierarchical namespace accounts

2026-10-08 10:53:05 +01:00

azurefiles

build: modernize with "go fix -newexpr": use go1.26 new(expr)

2026-08-21 12:23:31 +01:00

b2

b2: fix account token and SSE-C key leaking on redirects from --b2-download-url GHSA-gpw7-77cq-9f72 CVE-PENDING

2026-10-08 22:49:31 +01:00

box

box, serve s3: fix log messages with bad format strings

2026-09-20 14:23:50 +01:00

cache

cache: fix test flakiness by stopping the chunk cleaner promptly

2026-07-12 13:26:17 +01:00

chunker

chunker: fix panic listing a directory after an interrupted upload with meta_format none

2026-10-05 17:39:34 +01:00

cloudinary

build: modernize with "go fix -newexpr": use go1.26 new(expr)

2026-08-21 12:23:31 +01:00

combine

combine: don't return an error message as the remote name for a bad object

2026-07-16 14:47:03 +01:00

compress

compress: fix crash on ranged reads when gzip metadata is corrupted

2026-09-16 17:09:39 +01:00

crypt

build: fix lint errors from golangci-lint v2.14.0

2026-09-26 12:51:07 +01:00

doi

docs: fix typos in comments and messages

2026-01-18 20:48:33 +01:00

dosya

Add new backend dosya for dosya.dev cloud storage

2026-10-07 12:16:42 +01:00

drime

drime: fix deleted files and directories still being listed with hard_delete

2026-09-23 15:59:35 +01:00

drive

drive: reuse resumable-upload chunk buffers via multipart.NewRW

2026-08-30 13:07:41 +01:00

dropbox

dropbox: match shared-folder and received-file names case-insensitively - fixes #9706

2026-09-08 16:57:43 +01:00

fichier

fichier: fix server side move - fixes #7856

2024-09-06 18:20:10 +01:00

filefabric

build: modernize Go usage

2025-02-28 11:31:14 +00:00

filelu

filelu: reuse multipart upload buffers via the global pool and retry failed parts

2026-09-01 14:21:52 +01:00

filen

filen: fix incorrect modtime after updating a file or setting its modtime

2026-07-13 11:22:04 +01:00

filescom

filescom: fix corrupted uploads after a retried upload error

2026-09-05 12:14:46 +01:00

ftp

build: modernize with "go fix -stringscut": use strings.Cut

2026-08-21 12:23:31 +01:00

gofile

build: modernize with "go fix -errorsastype": use errors.AsType

2026-08-21 12:23:31 +01:00

googlecloudstorage

googlecloudstorage: improve endpoint parameter docs

2025-12-01 19:04:02 +00:00

googlephotos

drive, googlephotos: warn in config wizard before using the shared client_id #9580

2026-07-07 12:35:37 +01:00

hasher

hasher: fix Update not storing hashes in bolt DB after file replacement

2026-07-13 10:44:03 +01:00

hdfs

hdfs: fix incorrect modtime after uploading a file or setting its modtime

2026-07-13 13:53:29 +01:00

hidrive

hidrive: fix truncated file left behind when an upload hits --max-transfer

2026-10-05 17:39:34 +01:00

http

rest: add StripHeadersOnCrossHostRedirectFn and use it in the s3 and http backends

2026-10-08 22:38:27 +01:00

huaweidrive

huaweidrive: reuse resumable-upload chunk buffers via the global pool

2026-09-01 14:21:52 +01:00

iclouddrive

iclouddrive: fix potential crash looking up items

2026-09-22 11:03:16 +01:00

imagekit

imagekit: fix potential crash in rmdir and purge

2026-09-22 11:03:16 +01:00

internetarchive

internetarchive: fix corrupted files being created when the source ends early

2026-08-11 19:32:12 +01:00

internxt

internxt: fix server-side directory move failing after a gateway timeout

2026-09-23 16:00:46 +01:00

jottacloud

jottacloud: buffer MD5 pre-reads in the global memory pool

2026-09-01 14:21:52 +01:00

koofr

docs: fix some function names in comments

2025-06-24 15:04:45 +01:00

linkbox

linkbox: buffer the hashed 10 MiB file prefix in the global memory pool

2026-09-01 14:21:52 +01:00

local

local: fix .rclonelink names escaping the root with --links GHSA-55qp-jrwr-x827 CVE-PENDING

2026-10-08 22:49:33 +01:00

mailru

mailru: buffer speedup hashing in the global memory pool and fix upload retries

2026-09-01 14:21:52 +01:00

mega

mega: fix moved files disappearing from listings between remotes

2026-07-20 17:37:16 +01:00

memory

memory: add --memory-discard flag for speed testing - fixes #9037

2025-12-17 10:21:12 +00:00

netstorage

netstorage: fix missing MD5 hash after uploading a file

2026-07-14 14:13:49 +01:00

onedrive

onedrive: keep the delta token when a ChangeNotify poll fails - fixes #10009

2026-10-08 14:38:14 +01:00

opendrive

opendrive: reuse upload chunk buffers via the global memory pool

2026-09-01 14:21:52 +01:00

oracleobjectstorage

oracleobjectstorage: upload empty streams without multipart

2026-09-15 16:38:20 +01:00

overview

overview: fix "internal error: no overview data found" on 32 bit architectures - fixes #9723

2026-08-04 19:29:21 +01:00

pcloud

pcloud: only accept pCloud hosts from the hostname in the OAuth callback

2026-10-08 22:49:33 +01:00

pikpak

pikpak: use pooled memory for the gcid hash buffer and spool unknown-size uploads to disk

2026-09-01 14:21:52 +01:00

pixeldrain

pixeldrain: fix corrupted uploads after a retried upload error

2026-09-05 12:14:46 +01:00

premiumizeme

premiumizeme: fix uploading files with ";" in their names

2026-09-23 15:58:36 +01:00

protondrive

protondrive: fix Go 1.27 vet warning in retry test

2026-08-29 13:13:34 +01:00

putio

putio: reuse upload chunk buffers via the global memory pool

2026-09-01 14:21:52 +01:00

qingstor

walk: move NewListRHelper into list.Helper to avoid circular dependency

2025-04-08 15:14:00 +01:00

quatrix

quatrix: fix chunk upload retries and fix memory leak

2026-09-01 14:21:52 +01:00

s3

rest: add StripHeadersOnCrossHostRedirectFn and use it in the s3 and http backends

2026-10-08 22:38:27 +01:00

seafile

seafile: fix corrupted uploads after a retried upload error

2026-09-05 12:14:46 +01:00

sftp

sftp: fix failed uploads leaving disk space in use on the server - fixes #10033

2026-10-06 10:12:50 +01:00

shade

shade: fix potential crash in directory move

2026-09-22 11:03:16 +01:00

sharefile

build: modernize Go code with go fix for go1.25

2026-02-18 12:11:52 +00:00

sia

sia: fix corrupted files being created when the source ends early

2026-08-11 19:32:12 +01:00

smb

smb: save the user name in the config even if it matches the current user - fixes #9356

2026-09-21 17:27:57 +01:00

storj

build: fix linting issues reported by running golangci-lint with different GOOS

2024-04-22 19:29:12 +02:00

sugarsync

oauthutil: clarify token replacement prompt wording

2026-05-06 10:51:16 +01:00

swift

chore: fix some function names in comments

2026-07-02 11:30:15 +01:00

ulozto

ulozto: fix server side moves between differently rooted remotes losing files

2026-07-17 18:29:39 +01:00

union

build: remove x := x made unnecessary by the new semantics of loops in go1.22

2025-09-14 15:58:20 +01:00

webdav

webdav: retry Nextcloud chunk uploads individually - fixes #10005

2026-10-08 15:12:02 +01:00

yandex

yandex: add app_folder option to support cloud_api:disk.app_folder OAuth scope - Fixes #9848

2026-09-08 16:40:17 +01:00

zoho

build: modernize with "go fix -rangeint": use range over int

2026-08-21 12:23:31 +01:00