Nick Craig-Wood faaf716e9b rc: don't expose pprof debug handlers on an unauthenticated server GHSA-mfvx-7rcj-9m5g CVE-PENDING ...

The pprof debug handlers were accessible without authentication disclosing the
process command line (which can carry backend credentials passed on the command
line) and runtime profiles.

Mount the pprof handlers only when when auth is configured or --rc-no-auth was
passed - so they obey the same rule as the rc endpoints.

Addresses GHSA-mfvx-7rcj-9m5g finding 1.

2026-07-31 13:21:59 +01:00

..

commands

…

oracleobjectstorage

…

_index.md

s3: add Scality (RING / ARTESCA) provider

2026-07-28 17:35:11 +01:00

alias.md

…

amazonclouddrive.md

…

archive.md

…

authors.md

Add Punya Jain to contributors

2026-07-30 14:41:09 +01:00

azureblob.md

docs: azureblob,azurefiles: clarify documentation on use_az

2026-07-09 12:37:07 +01:00

azurefiles.md

azurefiles: improve modtime precision from 1s to 100ns

2026-07-14 14:13:49 +01:00

b2.md

…

backends.md

…

bisync.md

…

box.md

…

bugs.md

…

cache.md

…

changelog.md

Changelog updates from Version v1.74.4

2026-07-08 20:10:17 +01:00

chunker.md

…

cloudinary.md

…

combine.md

…

compress.md

…

contact.md

…

crypt.md

docs/crypt: fix encrypted size example - Fixes #9202

2026-06-15 12:49:36 +01:00

docker.md

…

docs.md

fs: fix passwords and tokens appearing in the debug log during rclone config

2026-07-16 16:11:22 +01:00

doi.md

…

downloads.md

…

drime.md

…

drive.md

drive: document shortcut IDs in lsf

2026-07-24 15:00:09 +01:00

dropbox.md

…

faq.md

…

fichier.md

…

filefabric.md

…

filelu.md

…

filen.md

…

filescom.md

…

filtering.md

filter: add --files-from0 to support NUL-delimited input - fixes #9537

2026-07-02 11:21:21 +01:00

flags.md

…

ftp.md

…

gofile.md

…

googlecloudstorage.md

…

googlephotos.md

drive, googlephotos: warn in config wizard before using the shared client_id #9580

2026-07-07 12:35:37 +01:00

gui.md

…

hasher.md

…

hdfs.md

…

hidrive.md

…

http.md

…

huaweidrive.md

…

iclouddrive.md

…

imagekit.md

…

install.md

…

install.sh

…

internetarchive.md

…

internxt.md

…

jottacloud.md

…

KEYS

…

koofr.md

…

licence.md

…

linkbox.md

…

local.md

local: stop --links symlinks escaping the destination directory CVE-2026-54572

2026-07-08 16:12:24 +01:00

mailru.md

…

mega.md

…

memory.md

…

netstorage.md

…

onedrive.md

…

opendrive.md

…

overview.md

…

pcloud.md

…

pikpak.md

…

pixeldrain.md

…

premiumizeme.md

…

privacy.md

…

protondrive.md

…

putio.md

…

qingstor.md

…

quatrix.md

…

rc.md

rc: don't expose pprof debug handlers on an unauthenticated server GHSA-mfvx-7rcj-9m5g CVE-PENDING

2026-07-31 13:21:59 +01:00

release_signing.md

…

remote_setup.md

docs: fix typo in remote setup docs

2026-06-28 23:53:05 +02:00

s3.md

s3: add Scality (RING / ARTESCA) provider

2026-07-28 17:35:11 +01:00

seafile.md

…

sftp.md

sftp: allow silencing no hostkey validation warning

2026-07-28 15:47:26 +01:00

shade.md

…

sharefile.md

…

sia.md

…

smb.md

…

sponsor.md

docs: update sponsors

2026-07-31 11:59:18 +01:00

storj.md

…

sugarsync.md

…

swift.md

…

tiers.md

…

ulozto.md

…

union.md

…

webdav.md

…

yandex.md

yandex: add --yandex-upload-wait to fix 500 errors when uploading

2026-07-30 20:01:18 +01:00

zoho.md

…