Commit Graph

1622 Commits

Author SHA1 Message Date
Shadowghost ca1f7af445 Fix incorrect year on local trailers 2026-07-21 20:27:04 +02:00
Cody Robibero 65836cc844 Merge pull request #17160 from 854562/truncate-language-strings
Truncate ISO-639-2 language display names at first delimiter
2026-07-21 11:22:32 -04:00
Tim Eisele ed61acc19a Fix subtitle encoding for local files (#17281)
* Fix subtitle encoding

* Add short-circuit

* Use IsTextFormat

* Update MediaBrowser.MediaEncoding/Subtitles/SubtitleEncoder.cs

Co-authored-by: Bond-009 <bond.009@outlook.com>

---------

Co-authored-by: Bond-009 <bond.009@outlook.com>
2026-07-21 14:52:59 +02:00
Bond-009 9b9b609c83 Merge pull request #17368 from Shadowghost/security-path-traversal-fixes
Backport and extend path traversal fixes
2026-07-21 14:52:40 +02:00
zerafachris 299810a4a9 fix: use build output directory for backup test temp root to avoid low free-space failures on Windows CI runners
BackupServiceTests rooted its temp directory under Path.GetTempPath(), which
on GitHub-hosted windows-latest runners resolves to the constrained system C:
drive. BackupService.CreateBackupAsync requires 5GiB free at the backup path
before starting, and the C: drive's free temp space can dip below that,
failing CreateBackupAsync_WithCorruptKeyframeDataRow_SkipsRowAndCompletesBackup
even though the fix itself is correct. Rooting the test directory under
AppContext.BaseDirectory keeps it on the same (much larger) drive as the repo
checkout on all platforms, without touching the real BackupService free-space
check.
2026-07-21 08:54:23 +02:00
zerafachris 53e58d8b1b Make ItemUpdateController.UpdateItem internal instead of reflection
Addresses review feedback from @Bond-009 on PR #17370: the test helper
InvokeUpdateItem was invoking the private UpdateItem(BaseItemDto, BaseItem)
method via reflection. Jellyfin.Api.csproj already grants
InternalsVisibleTo("Jellyfin.Api.Tests"), so the method is changed to
internal and the test now calls it directly, removing the
GetMethod/Invoke boilerplate.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-21 08:51:30 +02:00
Shadowghost b99703301f Merge remote-tracking branch 'upstream/master' into security-path-traversal-fixes
# Conflicts:
#	Jellyfin.Api/Controllers/HlsSegmentController.cs
#	Jellyfin.Api/Controllers/PluginsController.cs
2026-07-21 07:14:47 +02:00
Cody Robibero 557b14e33e Merge branch 'master' into fix/backup-skip-corrupt-keyframe-data 2026-07-20 20:49:37 -04:00
Cody Robibero c222d370ce Merge pull request #16933 from WizardOfYendor1/fix/livetv-guide-image-optimization
Feat (fix) - Skip reprocessing program information when importing XMLTV EPG data
2026-07-20 20:17:20 -04:00
Cody Robibero 23fa02eb59 Merge pull request #17282 from TowyTowy/fix/13137-clear-profile-image
Fix profile image being impossible to clear when its in-memory key is temporary
2026-07-20 19:58:43 -04:00
Cody Robibero bea016c962 Merge pull request #17320 from TaterTechStudios/fix/item-correct-selector
Fix: Fetch the correct row matching the most up to date file
2026-07-20 19:57:28 -04:00
Cody Robibero f2b9c68969 Merge pull request #17342 from LTe/fix-subtitle-conversion-race
Fix race condition in concurrent subtitle conversion
2026-07-20 19:51:44 -04:00
Cody Robibero 191be0931e Merge pull request #17254 from sjakub/attribute_aliases
Add additional attribute aliases and improve attribute detection
2026-07-20 19:45:06 -04:00
854562 2cd2f36fe4 Extract truncation logic to helper and add tests 2026-07-20 22:00:10 +02:00
Bond-009 5949be852a Fix SchedulesDirect image limit recognition (#17347) 2026-07-20 12:28:10 +02:00
gnattu a238d59a07 Remove libpostproc check for ffmpeg version validation (#17384)
Remove libpostproc check for ffmpeg version validation
2026-07-20 12:16:37 +02:00
Bond-009 236db6d2f6 Merge pull request #17365 from Shadowghost/fix-resume-perf
Fix Resume query performance
2026-07-20 08:17:38 +02:00
Bond-009 96727072c8 Merge pull request #17327 from Shadowghost/remove-playbackpositionticks-mediasourceinfo
Remove PlaybackPositionTicks from MediaSourceInfo
2026-07-17 22:21:21 +02:00
Bond-009 42f9ed76c0 Merge pull request #17280 from Shadowghost/remove-image-override-hack
Remove episode image override hack
2026-07-17 22:06:07 +02:00
Bond-009 69faa6c583 Merge pull request #17191 from IDisposable/fix/handler-path-traversal
Fix path transversal exposure in Plugins
2026-07-17 21:52:22 +02:00
WizardOfYendor1 0c7428f136 Added verbose, rambling, log warning to help users with config issues (hoping to reduce false issues reports).
Also added a test to exercise it, which is perhaps silly but convenient.
2026-07-17 14:59:46 -04:00
WizardOfYendor1 97e666c566 Append base URL if the published server URL override omits it. Fleshed out unit tests to cover that and https->http reverse proxy scenario(s). 2026-07-17 14:59:46 -04:00
zerafachris 5cd3d7ebb7 fix: don't throw ArgumentNullException on partial UpdateItem payloads (#17366)
BaseItemDto.Genres, .Tags, and .ProviderIds are plain auto-properties with
no default initializer, so they deserialize to null when a client omits
them from a partial POST /Items/{itemId} body. The OpenAPI spec documents
every BaseItemDto field as optional, but ItemUpdateController.UpdateItem
fed these three properties straight into Distinct()/Select()/ToList()
without a null check, so a request that (for example) only sets Tags
throws ArgumentNullException("source") once it reaches the unguarded
Genres line, before Tags is even processed.

Guard all three assignments with the same "if (request.X is not null)"
pattern already used for the neighboring Studios/Taglines/ProductionLocations
fields in this method, so omitted fields are left unchanged instead of
crashing the request.

Adds ItemUpdateControllerTests covering the reported repro (only Tags
supplied) and a companion case asserting existing Genres/ProviderIds are
preserved when omitted from the payload.

Signed-off-by: zerafachris <christopher.zerafa@blocklabs.io>
2026-07-17 17:20:30 +02:00
Shadowghost 62a5ded920 Prevent unauthenticated re-run of the startup wizard on misconfiguration 2026-07-17 17:14:27 +02:00
Shadowghost 21801e8ba1 Harden remaining path-construction sinks against traversal 2026-07-17 17:08:59 +02:00
Shadowghost 1a45fc82b5 Sanitize media attachment and lyric paths against traversal 2026-07-17 17:07:27 +02:00
Shadowghost 4fb779920a Sanitize ClientLog upload filename to prevent path traversal 2026-07-17 17:02:02 +02:00
zerafachris d7727224c2 Skip corrupt KeyframeData rows during full system backup
A single row with malformed KeyframeTicks JSON (e.g. a truncated array
from an interrupted write) currently aborts the entire backup, because
the try/catch in BackupService.CreateBackupAsync only wraps
serialization of an already-materialized entity, not the enumeration
itself. EF Core throws JsonReaderException from MoveNextAsync() while
materializing the corrupt row, which propagates past that catch block.

Switch to manual enumerator iteration so MoveNextAsync() failures can
be caught per-row, logged as a warning identifying the affected table,
and skipped, allowing the remaining rows and the rest of the backup to
complete.

Fixes #17216

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-17 16:44:25 +02:00
Shadowghost d894a98b79 Fix tie-breaker performance 2026-07-16 14:20:42 +02:00
Jordan Rushing 3f96790904 Move GetUserDataBatch to use ResolveUserDataRow when item.UserData isn't preloaded 2026-07-15 16:21:42 -05:00
Shadowghost 2bac9a8f0c Fix SchedulesDirect image limit recognition 2026-07-15 17:43:27 +02:00
Piotr Niełacny 6e3c187493 Fix race condition in concurrent subtitle conversion
SubtitleEncoder.ConvertSubtitles parsed subtitles with libse's static
Subtitle.Parse, which iterates a statically cached list of shared
SubtitleFormat instances. Format parsers keep mutable per-parse state on
the instance, so concurrent subtitle requests corrupted each other's
output (cues mixed across streams and languages, truncated files) or
failed with NullReferenceException when format detection broke down and
Subtitle.Parse returned null.

Parse through the injected ISubtitleParser instead. SubtitleEditParser
instantiates a fresh format parser per call, so requests no longer share
state. Its Parse method now returns the libse Subtitle directly (the
SubtitleTrackInfo flattening was unused since the SubtitleEdit writer
rework) so the writers keep full fidelity such as ASS styling.
2026-07-15 14:55:55 +02:00
Shadowghost b8bac71270 remove PlaybackPositionTicks from MediaSourceInfo 2026-07-14 10:05:32 +02:00
Jordan Rushing fcce108948 Fix: Fetch the correct row matching the most up to date file 2026-07-13 15:40:40 -05:00
TowyTowy 5be844e1b7 Fix 3D format detection when the tag is the last token of the path
Format3DParser drops the last character of the final path token: when
IndexOfAny finds no more delimiters, the slice is taken with
'index = path.Length - 1', so e.g. "hsbs" is compared as "hsb" and
never matches any rule.

File paths are unaffected because the extension is always the final
token, but directory based media have no extension. For DVD/BluRay
folder rips (BaseVideoResolver parses the folder path via
Set3DFormat), a trailing 3D tag such as
"Gravity (2013) 3d hsbs/BDMV" is silently ignored and Video3DFormat
is never set.

This is a regression from 42a2cc174 which replaced the string.Split
based FlagParser with span slicing; the Split implementation kept the
final token intact.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-12 12:11:29 +02:00
WizardOfYendor1 a3ec1a3712 Add Live TV published URL regression coverage 2026-07-10 20:27:10 -04:00
WizardOfYendor1 6bbd6dcd44 Resolve Live TV client stream URLs per request 2026-07-10 20:26:29 -04:00
WizardOfYendor1 ce43df6f43 Fix host and port handling for published server URI overrides 2026-07-10 14:19:08 -04:00
TowyTowy 2326ecdedc Fix profile image being impossible to clear when its in-memory key is temporary
ClearProfileImageAsync removed the ProfileImage instance attached to the
passed-in User, but that instance can carry a stale, never-persisted
(temporary) key because UpdateUserAsync creates the persisted image on a
separately loaded entity and never copies the generated key back.
Removing that detached entity on a fresh DbContext made EF Core throw
InvalidOperationException ('ImageInfo.Id has a temporary value'), leaving
the profile image impossible to delete or replace.

Load the tracked, persisted user and remove its actual ProfileImage,
matching the removal pattern already used in UpdateUserAsync. Adds
regression tests covering the temporary-key case and the no-image no-op
(the first fails before this change and passes after).

Fixes #13137

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-09 13:39:09 +02:00
Shadowghost 38813f7d42 Cleanup PreferEpisodeParentPoster) 2026-07-09 12:07:13 +02:00
Shadowghost 853922443f Remove episode image override hack 2026-07-09 11:54:18 +02:00
Jakub Schmidtke 1294990f4f Added more aliases for attributes
Adds tvdb alias for tvdbid and imdb alias for imdbid.

It also fixes an issue where tmdb alias was being ignored
if it was followed by something like "tmdbidfoo".
The same issue prevented imdb pattern matching from
working, if it was followed by something like "imdbidfoo".

It also allows for detecting the first matching occurence,
whether it was an alias or not.

Finally, it ignores attributes with values consisting of only whitespaces.
2026-07-07 15:39:09 +02:00
Cody Robibero 6e728b009f Merge pull request #17044 from Shadowghost/version-model-and-handling
Fixes for multi version handling
2026-07-05 16:21:02 -04:00
Enea D'Angiò 6883cd0969 Fix play queue index handling in SyncPlay
Three index bugs in PlayQueueManager, two of which leave
PlayingItemIndex out of bounds, making every subsequent Buffering/Ready
request throw and leaving the group unusable until it empties:

- RemoveFromPlaylist did not compensate for removed items preceding the
  playing item: removing the playing item together with earlier items
  could select the wrong item or crash with an out-of-bounds index.
- Next/Previous on an empty playlist with RepeatOne/RepeatAll reported
  success or set PlayingItemIndex to 0 on an empty list, crashing
  downstream in Group and corrupting the index.
- SetPlayingItemByIndex accepted an index equal to the playlist count
  (latent off-by-one, callers currently pre-validate).
2026-07-04 11:38:05 +02:00
Bond_009 482cf4b8c3 Allow changing capitalization of usernames
Fixes #17195
Adds a regression test
2026-07-03 18:33:10 +02:00
altqx 8622c3bfb7 Match VobSub MKS subtitle profiles by container 2026-07-03 09:30:22 +07:00
Enea D'Angiò 8f3eb3205d Close sessions for lost WebSockets to prevent zombie SyncPlay groups (#17079)
Close sessions for lost WebSockets to prevent zombie SyncPlay groups
2026-07-02 19:36:48 +02:00
Shadowghost 38f1d9749e Fix review comments 2026-07-02 08:49:11 +02:00
Bond-009 d3ee1e84b1 Merge pull request #17170 from Shadowghost/better-bitrates
Rework bitrate reporting
2026-06-29 18:06:14 +02:00
Marc Brooks 95cebffa87 Add tests
Also fixed a sibling directory that matches the prefix.
2026-06-28 16:26:35 -05:00