7 Commits

Author	SHA1	Message	Date
ShukeBta	fab2b98096	fix: enable CORS for all Emby protocol paths ... - Allow CORS for /emby/*, /Users/*, /Items/* routes - Supports all Emby-compatible players (Infuse, Emby apps, Jellyfin, etc)	2026-06-11 11:31:16 +08:00
ShukeBta	62b204367c	fix: auto-scan cloud libraries on boot + allow CORS for media playback ... - Add BootCloudLibraries() to auto-scan all cloud libraries on startup - Delay 3s to avoid conflict with system init, scan without auto-scrape - Enable CORS for /api/cloud/play/* and /api/img to support 3rd-party players - Fixes issue where each user triggers separate cloud library scans - Fixes issue where Infuse/Emby apps cannot play cloud resources	2026-06-11 11:25:43 +08:00
soldosluka857	5bbc9fadfe	security: fix SSRF, restrict CORS, add rate limiting on auth endpoints ... - Add isPrivateHost() to block image proxy requests to loopback/private/ link-local IPs (SSRF mitigation) - Add isAllowedLocalPath() to restrict local file reads to configured data/cache/media directories only - CORS middleware now takes debug flag; wildcard only when debug=true, production omits headers (same-origin enforced) - Add per-IP sliding-window rate limiter (10 req/min) on login/register and Emby AuthenticateByName endpoints Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2026-05-30 10:03:43 +08:00
ShukeBta	68a5a1e3c0	Fix Emby playback routes and stream compatibility	2026-05-28 16:00:09 +08:00
ShukeBta	32ccb33fed	Fix local adult metadata and watch history removal	2026-05-28 14:52:20 +08:00
ShukeBta	cbb4b806be	feat: merge conflict resolution, site management, UI fixes	2026-05-16 17:57:34 +08:00
Kiro	d5cf5fb4b2	feat: bootstrap MediaStationGo (Go + React rewrite of MediaStation) ... Adopt the cropflre/nowen-video tech stack and rebuild the project from scratch: - Backend: Go 1.25 + Gin + GORM + SQLite (WAL) + JWT + WebSocket hub. Layered packages config / database / model / repository / service / middleware / handler. Default admin (admin/admin123) seeded on first run; /api routes for auth, libraries, media, stream and admin panels. WebSocket scan-progress events at /api/ws. - Frontend: React 18 + Vite 5 + Tailwind 3.4 + Zustand + axios + react-router 6 + lucide-react + framer-motion + hls.js. Pages for Login / Home / Library / Search / MediaDetail / Player / Admin (Library, Users, Settings tabs). - Distribution: multi-arch Dockerfile (frontend -> backend -> Alpine runtime), docker-compose.yml, GitHub Actions for CI and GHCR publish, Makefile, env-prefixed config (MEDIASTATION_*). - Docs: README, CONTRIBUTING, .env.example, config.example.yaml. Backend builds, vets and tests pass. Frontend builds via tsc -b && vite build (250 kB JS / 16 kB CSS, gzipped 84 / 4 kB).	2026-05-14 15:26:29 +00:00