The request path is not validated to a valid path and could allow escaping the transcode path and downloading of any arbitrary file in GetHlsPlaylistLegacy .
GetHlsAudioSegmentLegacy and GetHlsVideoSegmentLegacy have the same issue, and are NOT behind an Authorize so they are publicly exploitable.
Added a ValidateTranscodePath that verifies that requested file paths start with the transcode path setting. Also ensure that all filename comparisons are OrdinalIgnoreCase because we might be running on a filesystem where filename-casing doesn't have to match. Switched from InvariantCulture because the underlying OS filename comparisons are always byte-wise (with case insensitivity here).
Fixed a similar issue in GetPluginImage
After resolving duplicates the migration deleted all items in one silent
pass (per-id GetItemById plus a single DeleteItemsUnsafeFast), which looks
hung for minutes on large libraries. Delete in batches of 500 and log
progress per batch, which also avoids one oversized delete transaction.
The FixIncorrectOwnerIdRelationships migration deletes all duplicate
items in a single DeleteItemsUnsafeFast -> DeleteItem(ids) call. Inside
DeleteItem, the owned-extras lookup used a raw HashSet.Contains, which EF
inlines as one SQL variable per id and overflows SQLite's variable limit
on large libraries. Use WhereOneOrMany so the id set is bound as a single
json_each parameter, like the rest of the method, making bulk deletes
work for unlimited library sizes.
GetProgressiveAudioFullCommandLine applied the libopus-only sample rate
quantization to every codec except Opus, inverting the intended guard.
A requested rate such as 44100 Hz was therefore snapped to 48000 Hz for
AAC/MP3/FLAC, while Opus (which actually requires the quantization) was
skipped entirely.
Apply the quantization only when the output codec is Opus, and pass the
requested sample rate through unchanged for all other codecs.
Fixes#17026
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
GET /Trailers is a thin alias for GET /Items with includeItemTypes=Trailer;
it just forwards to the injected ItemsController. Per the PR review the agreed
direction is to deprecate it rather than keep maintaining the delegation.
Mark the action [Obsolete] so it is flagged as deprecated in the OpenAPI spec;
clients should use the GetItems operation with includeItemTypes=Trailer instead.
Re #17065
Marc Brooks