soldosluka857 5bbc9fadfe security: fix SSRF, restrict CORS, add rate limiting on auth endpoints ...

- Add isPrivateHost() to block image proxy requests to loopback/private/
  link-local IPs (SSRF mitigation)
- Add isAllowedLocalPath() to restrict local file reads to configured
  data/cache/media directories only
- CORS middleware now takes debug flag; wildcard only when debug=true,
  production omits headers (same-origin enforced)
- Add per-IP sliding-window rate limiter (10 req/min) on login/register
  and Emby AuthenticateByName endpoints

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

2026-05-30 10:03:43 +08:00

..

adult_scraper_test.go

Update deployment docs and media library UI

2026-05-28 17:32:55 +08:00

adult_scraper.go

Update deployment docs and media library UI

2026-05-28 17:32:55 +08:00

ai_test.go

Update deployment docs and media library UI

2026-05-28 17:32:55 +08:00

ai.go

Update deployment docs and media library UI

2026-05-28 17:32:55 +08:00

api_config_svc.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

api_config.go

Update deployment docs and media library UI

2026-05-28 17:32:55 +08:00

aria2_adp.go

feat: merge conflict resolution, site management, UI fixes

2026-05-16 17:57:34 +08:00

assistant.go

feat: complete Vue UI parity (full backend + frontend)

2026-05-16 09:49:35 +00:00

audit.go

feat: downloads, RSS, subtitles, Bangumi, watcher, stats, profile, audit

2026-05-14 16:07:49 +00:00

auth_user_limits_test.go

fix: repair user password reset and recreate flow

2026-05-30 03:33:36 +08:00

auth.go

fix: repair user password reset and recreate flow

2026-05-30 03:33:36 +08:00

backup.go

feat: backup, notifier, organizer, douban, watch-history, poster-wall

2026-05-15 14:17:26 +00:00

bangumi.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

cache_cleanup.go

feat: port missing MediaStation features (DLNA, STRM, files, dup, sched, api-configs, emby, storage)

2026-05-15 10:58:32 +00:00

crypto_test.go

feat: port missing MediaStation features (DLNA, STRM, files, dup, sched, api-configs, emby, storage)

2026-05-15 10:58:32 +00:00

crypto.go

feat: merge conflict resolution, site management, UI fixes

2026-05-16 17:57:34 +08:00

discover.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

dlna.go

feat: complete Vue UI parity (full backend + frontend)

2026-05-16 09:49:35 +00:00

douban.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

download_adapter.go

feat: merge conflict resolution, site management, UI fixes

2026-05-16 17:57:34 +08:00

download_clients.go

fix: make qbittorrent login compatible

2026-05-29 04:15:44 +08:00

download_manager_svc.go

feat: merge conflict resolution, site management, UI fixes

2026-05-16 17:57:34 +08:00

downloads_test.go

feat: improve subscription and download cards

2026-05-28 23:27:34 +08:00

downloads.go

feat: align smart media classification paths

2026-05-29 02:08:38 +08:00

duplicate.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

emby_compat_test.go

fix: add global adult library visibility controls

2026-05-30 03:24:08 +08:00

emby_compat.go

fix: secure adult visibility and telegram bot access

2026-05-30 01:39:11 +08:00

episode_parser_test.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

episode_parser.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

external_search_test.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

external_search.go

feat: add licensing and access controls

2026-05-29 12:47:54 +08:00

fanart.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

ffmpeg_auto_install.go

feat: add licensing and access controls

2026-05-29 12:47:54 +08:00

ffprobe_test.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

ffprobe.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

filemanager.go

feat: port missing MediaStation features (DLNA, STRM, files, dup, sched, api-configs, emby, storage)

2026-05-15 10:58:32 +00:00

image_proxy_test.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

image_proxy.go

security: fix SSRF, restrict CORS, add rate limiting on auth endpoints

2026-05-30 10:03:43 +08:00

license.go

feat: add licensing and access controls

2026-05-29 12:47:54 +08:00

local_availability.go

feat: add licensing and access controls

2026-05-29 12:47:54 +08:00

local_metadata_test.go

fix: refresh library artwork previews

2026-05-29 10:13:34 +08:00

local_metadata.go

fix: prioritize local poster artwork

2026-05-29 09:52:16 +08:00

media_classifier_test.go

feat: align smart media classification paths

2026-05-29 02:08:38 +08:00

media_classifier.go

feat: align smart media classification paths

2026-05-29 02:08:38 +08:00

media_test.go

fix: map docker host library paths

2026-05-29 02:44:52 +08:00

media_tools.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

media_visibility_test.go

fix: add global adult library visibility controls

2026-05-30 03:24:08 +08:00

media.go

fix: add global adult library visibility controls

2026-05-30 03:24:08 +08:00

nfo.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

notifier.go

fix: improve telegram channel connectivity

2026-05-30 02:07:09 +08:00

notify_bark.go

feat: merge conflict resolution, site management, UI fixes

2026-05-16 17:57:34 +08:00

notify_channels.go

fix: stabilize telegram bot proxy and legacy permissions

2026-05-30 02:54:25 +08:00

notify_email.go

feat: merge conflict resolution, site management, UI fixes

2026-05-16 17:57:34 +08:00

notify_svc.go

feat: merge conflict resolution, site management, UI fixes

2026-05-16 17:57:34 +08:00

notify_telegram.go

fix: simplify telegram channel access rules

2026-05-30 02:16:18 +08:00

notify_webhook.go

feat: merge conflict resolution, site management, UI fixes

2026-05-16 17:57:34 +08:00

notify_wechat.go

feat: merge conflict resolution, site management, UI fixes

2026-05-16 17:57:34 +08:00

organizer_test.go

fix: keep existing library files in place

2026-05-29 03:04:27 +08:00

organizer.go

fix: keep existing library files in place

2026-05-29 03:04:27 +08:00

permission.go

feat: add licensing and access controls

2026-05-29 12:47:54 +08:00

play_profile_test.go

fix: isolate play profiles per user

2026-05-29 15:56:51 +08:00

play_profile.go

fix: isolate play profiles per user

2026-05-29 15:56:51 +08:00

playback.go

feat: ffprobe + TMDb scrape + HLS transcode + history/favourites/playlists

2026-05-14 15:44:31 +00:00

profile.go

fix: secure adult visibility and telegram bot access

2026-05-30 01:39:11 +08:00

proxy_other.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

proxy_test.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

proxy_windows.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

proxy.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

qbittorrent_adp.go

fix: make qbittorrent login compatible

2026-05-29 04:15:44 +08:00

qbittorrent_login.go

fix: make qbittorrent login compatible

2026-05-29 04:15:44 +08:00

qbittorrent_test.go

fix: make qbittorrent login compatible

2026-05-29 04:15:44 +08:00

qbittorrent.go

fix: make qbittorrent login compatible

2026-05-29 04:15:44 +08:00

runtime_settings_test.go

fix: enforce transcoding resource controls

2026-05-29 13:54:19 +08:00

runtime_settings.go

fix: enforce transcoding resource controls

2026-05-29 13:54:19 +08:00

scanner.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

scheduler.go

feat: port missing MediaStation features (DLNA, STRM, files, dup, sched, api-configs, emby, storage)

2026-05-15 10:58:32 +00:00

scraper_test.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

scraper.go

Update commit message generation

2026-05-28 14:52:52 +08:00

service.go

Update deployment docs and media library UI

2026-05-28 17:32:55 +08:00

site_adapter_test.go

Update deployment docs and media library UI

2026-05-28 17:32:55 +08:00

site_adapter.go

Update deployment docs and media library UI

2026-05-28 17:32:55 +08:00

site_test.go

Update deployment docs and media library UI

2026-05-28 17:32:55 +08:00

site.go

Update deployment docs and media library UI

2026-05-28 17:32:55 +08:00

sse_hub.go

feat: merge conflict resolution, site management, UI fixes

2026-05-16 17:57:34 +08:00

stats.go

feat: downloads, RSS, subtitles, Bangumi, watcher, stats, profile, audit

2026-05-14 16:07:49 +00:00

storage_config.go

feat: complete Vue UI parity (full backend + frontend)

2026-05-16 09:49:35 +00:00

storage.go

feat: port missing MediaStation features (DLNA, STRM, files, dup, sched, api-configs, emby, storage)

2026-05-15 10:58:32 +00:00

stream_test.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

stream.go

fix: enforce transcoding resource controls

2026-05-29 13:54:19 +08:00

strm_svc.go

feat: merge conflict resolution, site management, UI fixes

2026-05-16 17:57:34 +08:00

subscription_test.go

fix: avoid duplicate subscription downloads

2026-05-29 17:39:57 +08:00

subscription.go

fix: avoid duplicate subscription downloads

2026-05-29 17:39:57 +08:00

subtitle_test.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

subtitle.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

telegram_api_test.go

fix: ignore non-command telegram group messages

2026-05-30 03:04:30 +08:00

telegram_api.go

fix: stabilize telegram bot proxy and legacy permissions

2026-05-30 02:54:25 +08:00

telegram_bot_user_test.go

fix: repair user password reset and recreate flow

2026-05-30 03:33:36 +08:00

telegram_bot.go

fix: repair user password reset and recreate flow

2026-05-30 03:33:36 +08:00

thetvdb.go

Fix local adult metadata and watch history removal

2026-05-28 14:52:20 +08:00

tmdb.go

feat: add licensing and access controls

2026-05-29 12:47:54 +08:00

token_svc.go

feat: merge conflict resolution, site management, UI fixes

2026-05-16 17:57:34 +08:00

transcoder_test.go

fix: enforce transcoding resource controls

2026-05-29 13:54:19 +08:00

transcoder.go

fix: enforce transcoding resource controls

2026-05-29 13:54:19 +08:00

transmission_adp.go

feat: merge conflict resolution, site management, UI fixes

2026-05-16 17:57:34 +08:00

visibility.go

fix: add global adult library visibility controls

2026-05-30 03:24:08 +08:00

walk.go

feat: bootstrap MediaStationGo (Go + React rewrite of MediaStation)

2026-05-14 15:26:29 +00:00

watcher.go

feat: downloads, RSS, subtitles, Bangumi, watcher, stats, profile, audit

2026-05-14 16:07:49 +00:00

ws_hub.go

feat: bootstrap MediaStationGo (Go + React rewrite of MediaStation)

2026-05-14 15:26:29 +00:00