| Age | Commit message (Collapse) | Author |
|---|
|
security-path-traversal-fixes
# Conflicts:
# Jellyfin.Api/Controllers/HlsSegmentController.cs
# Jellyfin.Api/Controllers/PluginsController.cs
|
|
|
|
ClearProfileImageAsync removed the ProfileImage instance attached to the
passed-in User, but that instance can carry a stale, never-persisted
(temporary) key because UpdateUserAsync creates the persisted image on a
separately loaded entity and never copies the generated key back.
Removing that detached entity on a fresh DbContext made EF Core throw
InvalidOperationException ('ImageInfo.Id has a temporary value'), leaving
the profile image impossible to delete or replace.
Load the tracked, persisted user and remove its actual ProfileImage,
matching the removal pattern already used in UpdateUserAsync. Adds
regression tests covering the temporary-key case and the no-image no-op
(the first fails before this change and passes after).
Fixes #13137
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
|
|
|
Add lockhelper for UserManager
Original-merge: 39958ad9e51f83f520803aa9bc5e70e58f3a0836
Merged-by: Bond-009 <bond.009@outlook.com>
Backported-by: Bond_009 <bond.009@outlook.com>
|
|
Backport: Fix/user manager collation
|
|
|
|
|
|
I think some people need to change their IDE configuration ;)
|
|
|
|
|
