release: v1.2.2 — 双域名配置与 Host 隔离修复

修复设置页误清空管理域、配置与生效 URL 混淆及第三 Host 绕过隔离；加固 Settings API 与中间件，并更新文档站。

server/utils/serve-image.ts

@@ -8,6 +8,7 @@ import {
 } from './env'
 import { findImageKeyByDatePath, findImageKeyByFilename } from './image-index'
 import { validateImageKey } from './image-key'
+import { toStorageKeyFromPublicPath } from './image-public-path'
 import { buildPublicImageUrl } from './image-response'
 import { createImageStream, headImage } from './storage'
 import { getBackendRowForKey } from './storage/resolver'
@@ -80,15 +81,20 @@ export function requestPathToImageKey(
   options?: { hideFolder?: boolean }
 ): string | null {
   const raw = decodeURIComponent(pathname).replace(/^\/+/, '')
+  if (!raw) return null
+
   if (validateImageKey(raw)) return raw
 
-  if (options?.hideFolder) {
-    const byFilename = findImageKeyByFilename(raw)
-    if (byFilename && validateImageKey(byFilename)) return byFilename
+  const fromPublic = toStorageKeyFromPublicPath(raw)
+  if (fromPublic) return fromPublic
 
-    const byDatePath = findImageKeyByDatePath(raw)
-    if (byDatePath && validateImageKey(byDatePath)) return byDatePath
-  }
+  if (!options?.hideFolder) return null
+
+  const byFilename = findImageKeyByFilename(raw)
+  if (byFilename && validateImageKey(byFilename)) return byFilename
+
+  const byDatePath = findImageKeyByDatePath(raw)
+  if (byDatePath && validateImageKey(byDatePath)) return byDatePath
 
   return null
 }