system.listMethods just returns the available RPC method names. It
can be executed without secret token, because it just returns the
method names, and does not alter anything.
See GH-437
With --deferred-input=true, aria2 only reads input file to fill active
download slots, while keeping input file open. Meanwhile,
--save-session saves all download info inside memory, but this does
not take into account of unread item in input file. This will lead to
lose input data in saved session file. Also current BufferedFile
implementation used to read/write input/output file take a lock on
Windows. This effectively prevents session serializer from writing
session data to the same file which is still kept open because of
--deferred-input. See GH-493
Use one of the following to provide random bytes:
- Windows CryptGenRandom
- Linux getrandom (syscall interface to urandom, without nasty corner
cases such as file descriptor exhaustion or re-linked /dev/urandom)
- std::device_random (C++ random device, which usually will be urandom)
This also equalizes util::getRandom and SimpleRandomizer (the former
will now use the latter) instead of having essentially two different
PRNG interfaces with potentially different quality.
Closes GH-320
This commit fixes the bug that aria2.tellStopped RPC method returns
total length and completedLength as 0 when file size is unknown in
advance and turns out > 2GB in the end. This commit and addresses the
performance degradation in this case.
This change should make token validation more resilient to:
- timing attacks (constant time array compare)
- brute-force/dictionary attacks (PBKDF2)
Closes#220
This change changes the behavior of --bt-max-open-files. Previously,
it specifies the maximum number of opened files for each multi-file
download. Since it is more useful to limit the number globally, the
option now specifies the global limit. This change suggests that
aria2.changeOption() method now ignores --bt-max-open-files and
aria2.changeGlobalOption now reads it and dynamically change the
limit.