Merge remote-tracking branch 'origin/dev' into dev

kernel/model/assets.go

@@ -81,7 +81,7 @@ func NeedGenerateAssetsThumbnail(sourceImgPath string) bool {
 	if info.IsDir() {
 		return false
 	}
-	return info.Size() > 1024*10
+	return info.Size() > 1024*1024
 }
 
 func GenerateAssetsThumbnail(sourceImgPath, resizedImgPath string) (err error) {

kernel/server/serve.go

@@ -475,6 +475,12 @@ func serveAssets(ginServer *gin.Engine) {
 
 	ginServer.GET("/assets/*path", model.CheckAuth, func(context *gin.Context) {
 		requestPath := context.Param("path")
+		if "/" == requestPath || "" == requestPath {
+			// 禁止访问根目录 Disable HTTP access to the /assets/ path https://github.com/siyuan-note/siyuan/issues/15257
+			context.Status(http.StatusForbidden)
+			return
+		}
+
 		relativePath := path.Join("assets", requestPath)
 		p, err := model.GetAssetAbsPath(relativePath)
 		if err != nil {

kernel/sql/av_gallery.go

@@ -201,7 +201,10 @@ func fillAttributeViewGalleryCardCover(attrView *av.AttributeView, view *av.View
 			break
 		}
 
-		galleryCard.CoverURL = assetValue.MAsset[0].Content
+		p := assetValue.MAsset[0].Content
+		if util.IsAssetsImage(p) {
+			galleryCard.CoverURL = p
+		}
 		return
 	case av.CoverFromContentBlock:
 		blockValue := getBlockValue(cardValues)

kernel/util/path.go

@@ -317,6 +317,14 @@ var (
 	SiYuanAssetsVideo = []string{".mov", ".weba", ".mkv", ".mp4", ".webm"}
 )
 
+func IsAssetsImage(p string) bool {
+	ext := strings.ToLower(filepath.Ext(p))
+	if "" == ext {
+		return false
+	}
+	return gulu.Str.Contains(ext, SiYuanAssetsImage)
+}
+
 func IsDisplayableAsset(p string) bool {
 	ext := strings.ToLower(filepath.Ext(p))
 	if "" == ext {