aboutsummaryrefslogtreecommitdiff
path: root/Jellyfin.Server.Implementations/Users
AgeCommit message (Collapse)Author
36 hoursStop user updates from orphaning permission and preference rows (#17645)Tim Eisele
* Stop user updates from orphaning permission and preference rows * Make UserId non-nullable * Remove unnecessary ToList * Update Jellyfin.Server.Implementations/Users/UserManager.cs Co-authored-by: Claus Vium <cvium@users.noreply.github.com> --------- Co-authored-by: Claus Vium <cvium@users.noreply.github.com>
4 daysPrevent orphaned user permissions and preferences (#17643)m0g3r
Prevent orphaned user permissions and preferences
2026-07-21Apply review suggestionsShadowghost
2026-07-21Merge remote-tracking branch 'upstream/master' into ↵Shadowghost
security-path-traversal-fixes # Conflicts: # Jellyfin.Api/Controllers/HlsSegmentController.cs # Jellyfin.Api/Controllers/PluginsController.cs
2026-07-20Merge pull request #17282 from TowyTowy/fix/13137-clear-profile-imageCody Robibero
Fix profile image being impossible to clear when its in-memory key is temporary
2026-07-20Merge pull request #17302 from ElianCodes/fix/lastlogindate-stale-entityBond-009
Keep authenticated user entity in sync with persisted login timestamps
2026-07-17Harden remaining path-construction sinks against traversalShadowghost
2026-07-11Keep authenticated user entity in sync with persisted login timestampsElian Van Cutsem
ExecuteUpdateAsync bypasses the EF change tracker, so the user entity returned by AuthenticateUser still carried the old LastLoginDate and LastActivityDate. SessionManager.LogSessionActivity then saved that stale entity in full, reverting LastLoginDate (usually to null) milliseconds after every login. Setting the properties on the entity keeps the follow-up save consistent and lets the 60-second activity guard skip the redundant write during login. Fixes #17301
2026-07-09Fix profile image being impossible to clear when its in-memory key is temporaryTowyTowy
ClearProfileImageAsync removed the ProfileImage instance attached to the passed-in User, but that instance can carry a stale, never-persisted (temporary) key because UpdateUserAsync creates the persisted image on a separately loaded entity and never copies the generated key back. Removing that detached entity on a fresh DbContext made EF Core throw InvalidOperationException ('ImageInfo.Id has a temporary value'), leaving the profile image impossible to delete or replace. Load the tracked, persisted user and remove its actual ProfileImage, matching the removal pattern already used in UpdateUserAsync. Adds regression tests covering the temporary-key case and the no-image no-op (the first fails before this change and passes after). Fixes #13137 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-08Fix max login attemptstheguymadmax
2026-07-03Allow changing capitalization of usernamesBond_009
Fixes #17195 Adds a regression test
2026-06-07Backport pull request #16944 from jellyfin/release-10.11.zJPVenson
Add lockhelper for UserManager Original-merge: 39958ad9e51f83f520803aa9bc5e70e58f3a0836 Merged-by: Bond-009 <bond.009@outlook.com> Backported-by: Bond_009 <bond.009@outlook.com>
2026-05-26Backport: Fix/user manager collation (#16919)Bond-009
Backport: Fix/user manager collation
2026-05-05Backport changes from #15368JPVenson
2026-01-31Optimize Validator and Filter PerformanceShadowghost
2025-12-28Backport pull request #15752 from jellyfin/release-10.11.zCollin-Swish
Fix case sensitivity edge case Original-merge: b50ce1ad6b3239245897a648dd24cf407138abfc Merged-by: Bond-009 <bond.009@outlook.com> Backported-by: Bond_009 <bond.009@outlook.com>
2025-11-27Merge pull request #14950 from nielsvanvelzen/security-remove-has-passwordNiels van Velzen
Deprecate HasPassword property on UserDto
2025-11-02Backport pull request #15254 from jellyfin/release-10.11.zthornbill
Update password reset to always return the same response structure Original-merge: 4ad31418753840ca76c52fc2aa56fa1a4235ca87 Merged-by: crobibero <cody@robibe.ro> Backported-by: Joshua M. Boniface <joshua@boniface.me>
2025-10-05Truncate password reset file on open for writing (#14948)Bond-009
2025-10-05Deprecate HasPassword property on UserDtoNiels van Velzen
2025-09-20Attach before updating/deleting to avoid DbUpdateConcurrencyException (#14746)evan314159
2025-09-05Refactor Display preference manager (#14056)JPVenson
2025-08-06Revert "Merge pull request #13604 from Jxiced/master"Bond_009
This reverts commit ce78af2ed4f203690a0f9ef87b08b27a6bd43f63, reversing changes made to db7465e83d9cc07134a0bffad7ed17b1c7b873da.
2025-08-03Merge branch 'master' into masterJoshua M. Boniface
2025-03-30Rework parental ratings (#12615)Tim Eisele
2025-03-25Fixed namespacesJPVenson
2025-03-25WIP fixed namespacesJPVenson
2025-03-01Merge remote-tracking branch 'jellyfinorigin/master' into ↵JPVenson
feature/DatabaseRefactor
2025-02-23Move throw into interface to use in wizard, check for null and invalid username.Jxiced
2025-02-21Prevent whitespaces in username during wizard setup.Jxiced
2025-02-14Update Jellyfin.Server.Implementations/Users/UserManager.csJxiced
Co-authored-by: gnattu <gnattu@users.noreply.github.com>
2025-02-14Update regex and revert previous changes to ThrowIfInvalidUsername.Jxiced
2025-02-14Update ThrowIfInvalidUsername to include whitespaces.Jxiced
2025-01-29Changed UserName to non-deterministic fieldJPVenson
2025-01-26Prepared Seperation of Database components for future multi provider supportJPVenson
2024-11-03Added + in username regex validator, Test + in username, issue #10414 (#12819)SethPattee
2024-10-20Add catch to remove cached user if creation fails (#12574)JPVenson
2024-09-06Merge pull request #12552 from Bond-009/passwordhashingNiels van Velzen
Increase password hash iterations
2024-09-06Merge pull request #12545 from Bond-009/sha1Niels van Velzen
Remove passwordSha1 param from AuthenticateUser function
2024-08-30Increase password hash iterationsBond_009
It has been a while since this was last updated: https://github.com/jellyfin/jellyfin/pull/6818 Recommendations have changed since: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2
2024-08-30Remove BOM from UTF-8 filesBond_009
I think some people need to change their IDE configuration ;)
2024-08-30Remove passwordSha1 param from AuthenticateUser functionBond_009
2024-08-05Backport pull request #11901 from jellyfin/release-10.9.zgnattu
Implement Device Cache to replace EFCoreSecondLevelCacheInterceptor Original-merge: b7bc0e1c96553675a490c0bd92a58ad9c5f0d0e1 Merged-by: joshuaboniface <joshua@boniface.me> Backported-by: Bond_009 <bond.009@outlook.com>
2024-05-17Backport pull request #11670 from jellyfin/release-10.9.zgnattu
Restore caching for UserManager Original-merge: f8b67ec44cc6432d89d918f54caffa45eef037d0 Merged-by: nielsvanvelzen <nielsvanvelzen@users.noreply.github.com> Backported-by: Joshua M. Boniface <joshua@boniface.me>
2024-02-26Store lyrics in the database as media streams (#9951)Cody Robibero
2024-02-07Use IHostedService for device access managementPatrick Barron
2024-01-17Use helper function to compare guid (#10825)Cody Robibero
2024-01-06Remove UserManager Cache (#10781)Patrick Barron
* Remove redundant user cache * Use DI for IPasswordResetProvider and IAuthenticationProvider
2023-11-14Revert "Use System.Net.IPNetwork"Bond_009
This reverts commit 117d05d288da1d412159a29c0cb8d5c8259e48ae.
2023-11-14Fix warningsBond_009
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-22 04:53:05 +0000