soldosluka857 5bbc9fadfe security: fix SSRF, restrict CORS, add rate limiting on auth endpoints ...

- Add isPrivateHost() to block image proxy requests to loopback/private/
  link-local IPs (SSRF mitigation)
- Add isAllowedLocalPath() to restrict local file reads to configured
  data/cache/media directories only
- CORS middleware now takes debug flag; wildcard only when debug=true,
  production omits headers (same-origin enforced)
- Add per-IP sliding-window rate limiter (10 req/min) on login/register
  and Emby AuthenticateByName endpoints

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

2026-05-30 10:03:43 +08:00

..

admin.go

fix: repair user password reset and recreate flow

2026-05-30 03:33:36 +08:00

ai.go

fix: enforce adult profile pin visibility

2026-05-29 15:16:20 +08:00

api_config_handler.go

feat: merge conflict resolution, site management, UI fixes

2026-05-16 17:57:34 +08:00

api_config.go

feat: port missing MediaStation features (DLNA, STRM, files, dup, sched, api-configs, emby, storage)

2026-05-15 10:58:32 +00:00

assistant.go

feat: complete Vue UI parity (full backend + frontend)

2026-05-16 09:49:35 +00:00

auth_extra.go

feat: complete Vue UI parity (full backend + frontend)

2026-05-16 09:49:35 +00:00

auth.go

feat: merge conflict resolution, site management, UI fixes

2026-05-16 17:57:34 +08:00

backup.go

feat: backup, notifier, organizer, douban, watch-history, poster-wall

2026-05-15 14:17:26 +00:00

discover_extra.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

discover.go

feat: Emby 兼容层完整实现 + 多模块功能增强

2026-05-26 16:09:13 +08:00

dlna_extra.go

feat: complete Vue UI parity (full backend + frontend)

2026-05-16 09:49:35 +00:00

dlna.go

feat: port missing MediaStation features (DLNA, STRM, files, dup, sched, api-configs, emby, storage)

2026-05-15 10:58:32 +00:00

download_client_handler.go

feat: merge conflict resolution, site management, UI fixes

2026-05-16 17:57:34 +08:00

download_clients.go

feat: Emby 兼容层完整实现 + 多模块功能增强

2026-05-26 16:09:13 +08:00

downloads_extra.go

feat: complete Vue UI parity (full backend + frontend)

2026-05-16 09:49:35 +00:00

downloads.go

feat: improve subscription and download cards

2026-05-28 23:27:34 +08:00

duplicate.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

emby_test.go

Fix Emby playback routes and stream compatibility

2026-05-28 16:00:09 +08:00

emby.go

security: fix SSRF, restrict CORS, add rate limiting on auth endpoints

2026-05-30 10:03:43 +08:00

filemanager.go

feat: port missing MediaStation features (DLNA, STRM, files, dup, sched, api-configs, emby, storage)

2026-05-15 10:58:32 +00:00

handler.go

security: fix SSRF, restrict CORS, add rate limiting on auth endpoints

2026-05-30 10:03:43 +08:00

license.go

feat: add licensing and access controls

2026-05-29 12:47:54 +08:00

media_extra.go

fix: add global adult library visibility controls

2026-05-30 03:24:08 +08:00

media_favorite.go

feat: complete Vue UI parity (full backend + frontend)

2026-05-16 09:49:35 +00:00

media_test.go

fix: hide adult libraries across dashboard views

2026-05-30 03:50:52 +08:00

media.go

fix: hide adult libraries across dashboard views

2026-05-30 03:50:52 +08:00

metadata_enrich.go

feat: improve subscription and download cards

2026-05-28 23:27:34 +08:00

nfo.go

feat: hwaccel + Fanart/TheTVDB + AI + Discover + NFO + Tasks + Recycle bin

2026-05-14 16:22:08 +00:00

notify_channels.go

fix: 修复三个空白页面 + 许可证页面重构

2026-05-17 00:54:40 +08:00

notify_handler.go

feat: merge conflict resolution, site management, UI fixes

2026-05-16 17:57:34 +08:00

notify.go

feat: backup, notifier, organizer, douban, watch-history, poster-wall

2026-05-15 14:17:26 +00:00

organizer.go

feat: backup, notifier, organizer, douban, watch-history, poster-wall

2026-05-15 14:17:26 +00:00

permission_handler.go

chore: remove license code, fix compilation, update README bilingual

2026-05-17 00:02:41 +08:00

permissions.go

feat: add licensing and access controls

2026-05-29 12:47:54 +08:00

play_profile.go

fix: secure adult visibility and telegram bot access

2026-05-30 01:39:11 +08:00

playback_extra.go

fix: enforce adult profile pin visibility

2026-05-29 15:16:20 +08:00

playback.go

fix: enforce adult profile pin visibility

2026-05-29 15:16:20 +08:00

playlist_extra.go

feat: complete Vue UI parity (full backend + frontend)

2026-05-16 09:49:35 +00:00

profile_test.go

fix: require password only for adult visibility changes

2026-05-30 03:45:01 +08:00

profile.go

fix: require password only for adult visibility changes

2026-05-30 03:45:01 +08:00

recycle.go

feat: hwaccel + Fanart/TheTVDB + AI + Discover + NFO + Tasks + Recycle bin

2026-05-14 16:22:08 +00:00

refresh_handler.go

feat: merge conflict resolution, site management, UI fixes

2026-05-16 17:57:34 +08:00

response.go

feat: merge conflict resolution, site management, UI fixes

2026-05-16 17:57:34 +08:00

scheduler_handler.go

feat: merge conflict resolution, site management, UI fixes

2026-05-16 17:57:34 +08:00

scheduler.go

feat: port missing MediaStation features (DLNA, STRM, files, dup, sched, api-configs, emby, storage)

2026-05-15 10:58:32 +00:00

search_extra.go

fix: enforce adult profile pin visibility

2026-05-29 15:16:20 +08:00

series.go

fix: add global adult library visibility controls

2026-05-30 03:24:08 +08:00

site_handler.go

fix: 修复站点管理API Key保存问题，移动RSS字段到主表单，修复Discover页面提示

2026-05-18 01:22:11 +08:00

sites_extra.go

chore: remove license code, fix compilation, update README bilingual

2026-05-17 00:02:41 +08:00

sites.go

chore: remove license code, fix compilation, update README bilingual

2026-05-17 00:02:41 +08:00

stats_extra.go

fix: hide adult libraries across dashboard views

2026-05-30 03:50:52 +08:00

stats_test.go

fix: hide adult libraries across dashboard views

2026-05-30 03:50:52 +08:00

stats_user.go

feat: complete Vue UI parity (full backend + frontend)

2026-05-16 09:49:35 +00:00

stats.go

fix: hide adult libraries across dashboard views

2026-05-30 03:50:52 +08:00

storage_config.go

feat: complete Vue UI parity (full backend + frontend)

2026-05-16 09:49:35 +00:00

storage.go

feat: port missing MediaStation features (DLNA, STRM, files, dup, sched, api-configs, emby, storage)

2026-05-15 10:58:32 +00:00

streaming.go

fix: enforce adult profile pin visibility

2026-05-29 15:16:20 +08:00

strm.go

fix: keep existing library files in place

2026-05-29 03:04:27 +08:00

subscription_extra.go

feat: add licensing and access controls

2026-05-29 12:47:54 +08:00

subscriptions.go

feat: add licensing and access controls

2026-05-29 12:47:54 +08:00

subtitles.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

system_extra.go

fix: enforce transcoding resource controls

2026-05-29 13:54:19 +08:00

system_handler.go

feat: 站点适配器 FlareSolverr 集成 + 并发搜索优化

2026-05-24 17:14:47 +08:00

system_meta.go

feat: port remaining Vue UI surfaces with full backend support

2026-05-16 09:01:09 +00:00

tasks.go

feat: hwaccel + Fanart/TheTVDB + AI + Discover + NFO + Tasks + Recycle bin

2026-05-14 16:22:08 +00:00

telegram_webhook.go

TG Bot 命令交互 + UI 圆角色差深度优化 + 通知配置修复

2026-05-28 08:35:59 +08:00

util.go

feat: downloads, RSS, subtitles, Bangumi, watcher, stats, profile, audit

2026-05-14 16:07:49 +00:00

visibility.go

fix: add global adult library visibility controls

2026-05-30 03:24:08 +08:00

watch_history.go

fix: enforce adult profile pin visibility

2026-05-29 15:16:20 +08:00

ws.go

feat: bootstrap MediaStationGo (Go + React rewrite of MediaStation)

2026-05-14 15:26:29 +00:00