21801e8ba1
Harden remaining path-construction sinks against traversal
2026-07-17 17:08:59 +02:00
f8ffccae7f
Use InvariantCulture when parsing machine-generated dates
...
DateTime.TryParse without an IFormatProvider falls back to the current
thread culture, so the same string can parse differently (or fail)
depending on the server's locale. None of these call sites deal with
user-entered text - they parse dates that come from filenames, an
HTTP header, ffprobe metadata and values the app itself wrote to the
auth database - so InvariantCulture is the correct provider everywhere
here.
Fixes the S6580 / CA1305 warnings on these call sites.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-07-04 23:55:31 +02:00
8a1ad14faf
Fix review comment
2026-04-19 10:27:23 +02:00
342846e4fc
Add ImageInfo index
2026-01-18 19:48:46 +01:00
7320e10329
readd Format for splashscreen and user image
2025-07-27 23:12:40 +00:00
5b544bf1ed
Remove even obsoleter code
2025-07-27 21:17:20 +00:00
1a1d9b2404
Remove obsolete code
2025-07-27 21:16:45 +00:00
96a05276a6
Removed all server side processing options from public endpoints for image gen
2025-07-27 21:15:18 +00:00
9c7cf808aa
allow admin users to get Splashscreen even when disabled ( #13825 )
...
refactor
2025-04-02 16:32:53 -06:00
42bdb22bfb
Fixed namespaces
2025-03-25 16:45:00 +01:00
8c3f3c503b
Merge pull request #11665 from Bond-009/getuserbyid
2024-08-28 12:39:48 -06:00
cb83dc2664
Backport pull request #12490 from jellyfin/release-10.9.z
...
Set Content-Disposition header to attachment for image endpoints
Original-merge: 9645955629cody@robibe.ro >
Backported-by: Joshua M. Boniface <joshua@boniface.me >
2024-08-25 02:46:38 -04:00
4549337335
Change arguments AssertCanUpdateUser to take a user
2024-08-05 17:17:57 +02:00
6fb6b5f176
Validate item access ( #11171 )
2024-04-14 08:18:36 -06:00
6e5ec99ea1
Move userId in API from route to optional query parameter ( #11074 )
...
* Move userId in API from route to optional query parameter
* Standardize UserViewsController
* Move userId to query in ImageController
* Move userId to query in ItemsController
* Move userId to query in PlaystateController
* Move userId to query in SuggestionsController
* Move userId from route to query in UserLibraryController
* Clean up routes
* Move userId to query in UserController
* fix bad merge
---------
Co-authored-by: Niels van Velzen <git@ndat.nl >
2024-03-03 13:51:31 -07:00
c5e723bccd
Add support for converting from svg to other image types
2024-02-28 09:56:02 -07:00
635d67d458
Revert "Use System.Net.IPNetwork"
...
This reverts commit 117d05d288da1d412159a29c0cb8d5c8259e48ae.
2023-11-14 21:16:33 +01:00
b62b0ec2b5
Fix warnings
2023-11-14 21:14:21 +01:00
de0241e975
Move API policies to MediaBrowser.Common
2023-11-12 10:24:35 -05:00
efc4c305a9
Use CryptoStream to convert stream from base64
...
Should be way more efficient
2023-10-05 23:36:37 +02:00
60f41b80f6
Verify ContentType of uploaded images
2023-02-16 15:08:01 +01:00
52e2776d8e
Merge branch 'master' into simplify_authz
...
# Conflicts:
# Jellyfin.Api/Auth/SyncPlayAccessPolicy/SyncPlayAccessHandler.cs
2023-02-12 22:59:48 +01:00
209edd38a4
refactor: simplify authz
2023-02-09 13:51:37 +01:00
52230d1c30
Return NotFound when itemId isn't found
2023-02-04 20:11:08 +01:00
f5f890e685
Migrate to file-scoped namespaces
2023-02-02 18:50:33 +01:00
abffd160c3
Remove ability to add a played indicator to images ( #9186 )
2023-01-28 07:43:13 -07:00
56ef45ebf0
Fix client supported image formats ( #9071 )
2023-01-14 13:15:50 -07:00
69a51c425a
Fix all warnings in Jellyfin.Api ( #9003 )
2023-01-04 08:01:31 -07:00
cf67381e31
Fix release build
2022-12-07 16:44:00 +01:00
52194f56b5
Replace != null with is not null
2022-12-05 15:01:13 +01:00
c7d50d640e
Replace == null with is null
2022-12-05 15:00:20 +01:00
5dc30c6a6d
fix: use HttpContext and ClaimsPrincipal instead of IAuthorizationContext
2022-10-06 13:57:47 +02:00
bee13d5644
Fix splashscreen ( #7895 )
2022-06-14 19:34:29 -04:00
b37052a4a6
Fix build
2022-03-06 06:34:04 -07:00
2579b2db56
Merge pull request #7137 from SenorSmartyPants/master
2022-03-05 20:54:36 +01:00
e5701c396a
Merge pull request #6436 from daullmer/splashscreen
2022-01-28 08:12:21 -07:00
8a36fe7ed5
Use png for storage
2022-01-10 17:01:17 -07:00
0d335082c8
suggestions from review
2022-01-10 10:59:32 -07:00
ecb73168b3
Suggestions from review
2022-01-10 08:26:30 -07:00
3ea54a8009
Remove isHeadRequest from GetStaticFile method signatures
2022-01-07 18:21:48 -06:00
bd2bec4d4a
Remove special HTTP HEAD processing
...
removing this allows HTTP 206 Partial Content responses and lets some clients(popcorn hour namely) play videos from JF.
2022-01-07 16:29:22 -06:00
360fd70fc7
Clean up
2022-01-04 08:44:03 -07:00
9e0958d822
Apply suggestions from code review
2022-01-04 08:20:16 -07:00
c70452b4a4
Add missing response code documentation
2022-01-04 08:20:16 -07:00
68db3be0e7
Remove darkening filter from Splashscreen
...
Using the foregroundLayer parameter has the same effect
2022-01-04 08:20:16 -07:00
e026ba84c5
Add Splashscreen API endpoint to ImageController
2022-01-04 08:20:16 -07:00
dc222b75c5
Remove incorrect mime type image/jpg
2022-01-04 10:40:16 +01:00
9234e5bf80
Remove all instances of en-US culture
2021-09-26 09:11:25 -06:00
13fbfe6091
Target net6.0
2021-09-24 20:15:46 +02:00
a0c6f72762
Migrate authentication db to EF Core
2021-05-20 23:56:59 -04:00
Shadowghost