soldosluka857 5bbc9fadfe security: fix SSRF, restrict CORS, add rate limiting on auth endpoints ...

- Add isPrivateHost() to block image proxy requests to loopback/private/
  link-local IPs (SSRF mitigation)
- Add isAllowedLocalPath() to restrict local file reads to configured
  data/cache/media directories only
- CORS middleware now takes debug flag; wildcard only when debug=true,
  production omits headers (same-origin enforced)
- Add per-IP sliding-window rate limiter (10 req/min) on login/register
  and Emby AuthenticateByName endpoints

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

2026-05-30 10:03:43 +08:00

..

emby_auth_test.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

emby_auth.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

middleware.go

security: fix SSRF, restrict CORS, add rate limiting on auth endpoints

2026-05-30 10:03:43 +08:00

permission.go

feat: merge conflict resolution, site management, UI fixes

2026-05-16 17:57:34 +08:00