Merge commit from fork

fix(tls): harden defaults and warn on insecure mode

Author: okatu-loli

drivers/webdav/meta.go

@@ -11,7 +11,6 @@ type Addition struct {
 	Username string `json:"username" required:"true"`
 	Password string `json:"password" required:"true"`
 	driver.RootPath
-	TlsInsecureSkipVerify bool `json:"tls_insecure_skip_verify" default:"false"`
 }
 
 var config = driver.Config{

drivers/webdav/util.go

@@ -6,6 +6,7 @@ import (
 	"net/http/cookiejar"
 
 	"github.com/alist-org/alist/v3/drivers/webdav/odrvcookie"
+	"github.com/alist-org/alist/v3/internal/conf"
 	"github.com/alist-org/alist/v3/internal/model"
 	"github.com/alist-org/alist/v3/pkg/gowebdav"
 )
@@ -20,7 +21,7 @@ func (d *WebDav) setClient() error {
 	c := gowebdav.NewClient(d.Address, d.Username, d.Password)
 	c.SetTransport(&http.Transport{
 		Proxy:           http.ProxyFromEnvironment,
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: d.TlsInsecureSkipVerify},
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: conf.Conf.TlsInsecureSkipVerify},
 	})
 	if d.isSharepoint() {
 		cookie, err := odrvcookie.GetCookie(d.Username, d.Password, d.Address)

internal/bootstrap/config.go

@@ -70,6 +70,15 @@ func InitConfig() {
 	if !conf.Conf.Force {
 		confFromEnv()
 	}
+	if conf.Conf.TlsInsecureSkipVerify {
+		log.Warn("SECURITY WARNING / 安全警告:")
+		log.Warn("TLS certificate verification is disabled.")
+		log.Warn("TLS 证书校验已被禁用。")
+		log.Warn("This exposes all storage traffic to MitM attacks and may leak credentials or allow data tampering.")
+		log.Warn("这会使所有存储通信暴露于中间人攻击（MitM），可能导致凭据泄露和数据被篡改。")
+		log.Warn("Only use this setting if you fully understand the risks.")
+		log.Warn("仅在你完全理解风险的情况下使用该配置。")
+	}
 	// convert abs path
 	if !filepath.IsAbs(conf.Conf.TempDir) {
 		absPath, err := filepath.Abs(conf.Conf.TempDir)

internal/conf/config.go

@@ -156,7 +156,7 @@ func DefaultConfig() *Config {
 		},
 		MaxConnections:        0,
 		MaxConcurrency:        64,
-		TlsInsecureSkipVerify: true,
+		TlsInsecureSkipVerify: false,
 		Tasks: TasksConfig{
 			Download: TaskConfig{
 				Workers:  5,

server/handles/ldap_login.go

@@ -150,7 +150,7 @@ func dial(ldapServer string) (*ldap.Conn, error) {
 	}
 
 	if tlsEnabled {
-		return ldap.DialTLS("tcp", ldapServer, &tls.Config{InsecureSkipVerify: true})
+		return ldap.DialTLS("tcp", ldapServer, &tls.Config{InsecureSkipVerify: conf.Conf.TlsInsecureSkipVerify})
 	} else {
 		return ldap.Dial("tcp", ldapServer)
 	}