| Age | Commit message (Collapse) | Author |
|---|
|
|
|
Fix Live TV returning unreachable "server-local" streaming URLs to clients.
|
|
# Conflicts:
# src/Jellyfin.Database/Jellyfin.Database.Providers.Sqlite/Migrations/JellyfinDbModelSnapshot.cs
|
|
Skip SIDX in fMP4 HLS segments
|
|
Prevent FFmpeg's SIDX path from rewriting open-GOP boundary packet timestamps. HLS uses the media playlist for segment indexing and does not require the SIDX box.
|
|
user can access
|
|
ItemCounts
|
|
TheMelmacian/feature/library_specific_language_filter_values
Improve language filters to only fetch language codes that match the requested items/libraries (follow up to #9787)
|
|
fix: don't throw ArgumentNullException on partial UpdateItem payloads (#17366)
|
|
Prevent unauthenticated re-run of the startup wizard on misconfiguration
|
|
Addresses review feedback from @Bond-009 on PR #17370: the test helper
InvokeUpdateItem was invoking the private UpdateItem(BaseItemDto, BaseItem)
method via reflection. Jellyfin.Api.csproj already grants
InternalsVisibleTo("Jellyfin.Api.Tests"), so the method is changed to
internal and the test now calls it directly, removing the
GetMethod/Invoke boilerplate.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
|
security-path-traversal-fixes
# Conflicts:
# Jellyfin.Api/Controllers/HlsSegmentController.cs
# Jellyfin.Api/Controllers/PluginsController.cs
|
|
Make RequestHelpers.GetOrderBy generic and reuse it in ActivityLogController
|
|
|
|
Update season and episode SeriesName when renaming a series
|
|
Remove episode image override hack
|
|
Fix path transversal exposure in Plugins
|
|
BaseItemDto.Genres, .Tags, and .ProviderIds are plain auto-properties with
no default initializer, so they deserialize to null when a client omits
them from a partial POST /Items/{itemId} body. The OpenAPI spec documents
every BaseItemDto field as optional, but ItemUpdateController.UpdateItem
fed these three properties straight into Distinct()/Select()/ToList()
without a null check, so a request that (for example) only sets Tags
throws ArgumentNullException("source") once it reaches the unguarded
Genres line, before Tags is even processed.
Guard all three assignments with the same "if (request.X is not null)"
pattern already used for the neighboring Studios/Taglines/ProductionLocations
fields in this method, so omitted fields are left unchanged instead of
crashing the request.
Adds ItemUpdateControllerTests covering the reported repro (only Tags
supplied) and a companion case asserting existing Genres/ProviderIds are
preserved when omitted from the payload.
Signed-off-by: zerafachris <christopher.zerafa@blocklabs.io>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Use InvariantCulture when parsing machine-generated dates
|
|
Fixes for multi version handling
|
|
DateTime.TryParse without an IFormatProvider falls back to the current
thread culture, so the same string can parse differently (or fail)
depending on the server's locale. None of these call sites deal with
user-entered text - they parse dates that come from filenames, an
HTTP header, ffprobe metadata and values the app itself wrote to the
auth database - so InvariantCulture is the correct provider everywhere
here.
Fixes the S6580 / CA1305 warnings on these call sites.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
|
|
|
Fix Book collections speed issues
|
|
Also fixed a sibling directory that matches the prefix.
|
|
The request path is not validated to a valid path and could allow escaping the transcode path and downloading of any arbitrary file in GetHlsPlaylistLegacy .
GetHlsAudioSegmentLegacy and GetHlsVideoSegmentLegacy have the same issue, and are NOT behind an Authorize so they are publicly exploitable.
Added a ValidateTranscodePath that verifies that requested file paths start with the transcode path setting. Also ensure that all filename comparisons are OrdinalIgnoreCase because we might be running on a filesystem where filename-casing doesn't have to match. Switched from InvariantCulture because the underlying OS filename comparisons are always byte-wise (with case insensitivity here).
Fixed a similar issue in GetPluginImage
|
|
Added static method GetBaseItemKindsForCollectionType in ItemsController (moved from ContentFolderImageProvider to be shared)
Added AudioBook to GetRepresentativeItemTypes for CollectionType.books for consistency
Added GetBooks to GetUserItems for CollectionType.books which gets BaseItemKind.Book and BaseItemKind.AudioBook
Move GetBaseItemKindsForCollectionType to DtoExtensions
Cleaned up the missing null checks and used new collection expressions.
Associate Person to Book and AudioBook for related items.
|
|
|
|
moontwister/fix/trailers-nullref-controllercontext-17065
Deprecate the redundant /Trailers endpoint
|
|
GET /Trailers is a thin alias for GET /Items with includeItemTypes=Trailer;
it just forwards to the injected ItemsController. Per the PR review the agreed
direction is to deprecate it rather than keep maintaining the delegation.
Mark the action [Obsolete] so it is flagged as deprecated in the OpenAPI spec;
clients should use the GetItems operation with includeItemTypes=Trailer instead.
Re #17065
|
|
|
|
|
|
|
|
|
|
|
|
Implement search providers
|
|
Co-authored-by: Bond-009 <bond.009@outlook.com>
|
|
|
|
Only default recursive to true if we have includeItemTypes
|
|
Trim tags
|
|
Fix recently added episode links and posters
|
|
|
