A preexisting executable in a world-writable temp path could have been
planted by another local user; only reuse the cache when the directory
is verifiably ours, and otherwise build in a per-process directory.
The proxy/native frontends terminate the client TCP connection, so the
Go backend saw loopback peers and -whiteList could not be enforced.
The launcher now passes -proxyProtocol and prepends a PROXY v1 line to
each proxied connection; opted-in listeners unwrap it and expose the
real client address to HTTP and gRPC checks.
The native pre-check rejected every upload carrying Content-MD5, even when
the checksum was correct; the backend accepts matching checksums and only
rejects mismatches.
The native handlers returned fabricated empty content for /status,
/healthz, /favicon.ico, /seaweedfsstatic, and /ui/index.html, hiding the
real server state behind 200 responses. Let those paths fall through to
the supervised backend so it serves the real data; keep the parity-only
native checks (OPTIONS, method gating, request validation).
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Rewriting the backend's -ip and ports made its heartbeat register the
private loopback backend instead of the listener clients should use.
When the frontend ports can also be bound on a non-conflicting address
(loopback alias for loopback frontends, 127.0.0.1 for remote ones), run
the backend there with the frontend identity so master advertises the
proxy; otherwise keep the old loopback-plus-random-ports fallback.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Each accepted connection previously spawned an unbounded worker thread
that could block forever in peek, letting idle clients exhaust threads.
Cap in-flight connections per listener and give the header peek a read
deadline, cleared again before traffic is proxied.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The integration harness passes rust-native flags (--port, --ip.bind,
--securityFile). Translate --securityFile into the weed-level -config_dir
flag placed before the volume subcommand, and teach flag parsing and
rewriting to match single- and double-dash forms.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
user.email