mirror of
https://github.com/rclone/rclone.git
synced 2026-07-09 07:15:27 -04:00
874a804f52
With -l/--links rclone recreates a .rclonelink object as a symlink. A
malicious or compromised source could serve a symlink whose target points
outside the destination, plus a sibling object whose path traverses it, so
that rclone followed the planted symlink and wrote outside the destination
causing arbitrary file write.
When translating symlinks, rclone now performs all destination writes
(directory creation, file writes and symlink creation) through an os.Root
anchored at the destination. os.Root resolves every path component relative
to the destination's file descriptor and refuses any that escapes the root,
even under concurrent modification, so a planted symlink can never be
traversed out of the destination.
Symlinks are still reproduced verbatim - including ones whose target points
outside the destination - so backups remain faithful. Only writing
*through* such a link is refused. In-tree symlinks are unaffected.
Fixes CVE-2026-54572
Fixes GHSA-cf44-9pgv-m4xc
(cherry picked from commit 1154afebee)
Docs
This directory tree is used to build all the different docs for rclone.
See the content directory for the docs in markdown format.
Note that some of the docs are auto-generated - these should have a DO NOT EDIT marker near the top.
Use hugo to build the website.
Changing the layout
If you want to change the layout then the main files to edit are
layout/index.htmlfor the front pagechrome/*.htmlfor the HTML fragments_default/single.mdfor the default templatepage/single.mdfor the page template
Running make serve in a terminal give a live preview of the website
so it is easy to tweak stuff.
What are all these files
├── config.json - hugo config file
├── content - docs and backend docs
│ ├── _index.md - the front page of rclone.org
│ ├── commands - auto-generated command docs - DO NOT EDIT
├── i18n
│ └── en.toml - hugo multilingual config
├── layouts - how the markdown gets converted into HTML
│ ├── 404.html - 404 page
│ ├── chrome - contains parts of the HTML page included elsewhere
│ │ ├── footer.copyright.html - copyright footer
│ │ ├── footer.html - footer including scripts
│ │ ├── header.html - the whole html header
│ │ ├── header.includes.html - header includes e.g. css files
│ │ ├── menu.html - left hand side menu
│ │ ├── meta.html - meta tags for the header
│ │ └── navbar.html - top navigation bar
│ ├── _default
│ │ └── single.html - the default HTML page render
│ ├── index.html - the index page of the whole site
│ ├── page
│ │ └── single.html - the render of all "page" type markdown
│ ├── partials - bits of HTML to include into layout .html files
│ │ └── version.html - the current version number
│ ├── rss.xml - template for the RSS output
│ ├── section - rendering for sections
│ │ └── commands.html - rendering for /commands/index.html
│ ├── shortcodes - shortcodes to call from markdown files
│ │ ├── cdownload.html - download the "current" version
│ │ ├── download.html - download a version with the partials/version.html number
│ │ ├── provider.html - used to make provider list on the front page
│ │ └── version.html - used to insert the current version number
│ └── sitemap.xml - sitemap template
├── public - render of the website
├── README.md - this file
├── resources - don't know!
│ └── _gen
│ ├── assets
│ └── images
└── static - static content for the website
├── css
│ ├── bootstrap.css
│ └── custom.css - custom css goes here
├── fontawesome
│ ├── css
│ └── webfonts
├── img - images used
├── js
│ ├── bootstrap.js
│ ├── custom.js - custom javascript goes here
│ └── jquery.js