v2.2.0 — Responsive Design & Security Hardening

🎬 XFlix v2.2.0

Responsive Design & UX

• Full responsive layout for all screen sizes: ultra-wide (>1920 px), large desktop, tablet landscape (≤1024 px), tablet portrait (≤768 px), phone (≤480 px), small phone (≤360 px).
• Mobile bottom navigation bar — visible below 768 px, replaces the hidden desktop nav links.
• Fullscreen player cleanup — related videos and comments are automatically hidden when the video player enters fullscreen mode.
• Video player controls, modals, grids, cards, and filters all adapt to each breakpoint.

Security Hardening

• requireAdmin re-validates role from DB — demotions now take effect immediately instead of being ignored until JWT expiry (7 days).
• Removed hardcoded DB password fallback (db.js) — the pool no longer silently uses a default password when DB_PASS is missing.
• HTML injection fix in password-reset emails — username and resetUrl are now escaped before HTML template interpolation.
• Stored XSS mitigation in comments — HTML tags are stripped from comment content on write.
• LIKE wildcard escaping — % and _ characters in search input are now escaped to prevent unexpected wildcard matching.

Install Script

• Admin account creation now passes credentials via environment variables instead of shell string interpolation (prevents injection from special characters in passwords).
• Credential summary no longer prints secrets to the terminal — references .admin-creds and .env files instead.

Commits since v2.0.0

• 7fdb4e6 v2.2: security hardening, responsive design docs, install.sh improvements
• 5ebfec7 feat: responsive design (all screens) + hide suggestions in fullscreen

Full Changelog: v1.0.0...v2.2.0

v1.0.0

Changelog

All notable changes to this project will be documented in this file.

v1.0.0 — First stable release

Release date: 2026-02-19

Summary

First stable release of XFlix — a self-hosted media browser for local video and photo collections with a Netflix-like UI, admin panel, and CLI tools.

Added

• Performer-based browsing (one folder = one performer).
• Video streaming with HTTP Range requests (seek, pause/resume).
• Photo lightbox with full-screen view and keyboard navigation.
• Asynchronous, incremental file scanner (non-blocking, batch DB inserts).
• Automatic thumbnail generation (photos via sharp, videos via ffmpeg).
• Video metadata enrichment (duration extraction via ffprobe).
• Public REST API for performers, media, search, stats and discovery.
• JWT authentication: register / login / profile / password reset flows.
• Per-media comments and like/dislike reactions.
• Personal favourites (per-user) and global favourites (admin-set).
• Admin panel: scan (SSE), batch thumbnail generation (SSE), duplicate detection, cleanup tools, purge short videos, user management, SMTP settings.
• CLI utilities: node cli.js scan, node cli.js clear.
• install.sh for one-shot provisioning (nvm/Node, MariaDB, ffmpeg, PM2).
• Comprehensive README.md and improved .gitignore + .gitkeep to track data/thumbs directory.

Changed / Optimized

• Database access optimized: batch inserts, appropriate indexes for fast sorting/filters.
• random_cover_id stored per performer to avoid ORDER BY RAND() at runtime.
• Selective gzip compression (skip media & SSE) to avoid double compression.
• Frontend improvements: global IntersectionObserver for thumbnails, client-side retry/backoff for thumbnail requests.

Fixed

• Thumbnail generation flood fixed: server-side semaphore limits concurrent ffmpeg/sharp jobs (max 3), with dedup and fast-fail 503 when saturated to keep browser connections free.
• Replaced an aggressive inline onerror strategy that opened too many video streams and caused "Failed to fetch" errors.
• Various admin & scanner fixes to handle deep directories and large collections reliably.

Performance

• Scanner designed to handle very large libraries (50k+ files) without blocking the event loop.
• Background enrichment/generation runs with bounded concurrency to avoid resource exhaustion.

Security & Configuration

• Password hashing via bcrypt (bcryptjs used in code for portability).
• Secrets & credentials live in .env — change JWT_SECRET and DB passwords before exposing publicly.
• Recommended to run behind a reverse proxy (nginx/Caddy) with HTTPS.

Migration / Post-install notes

• Requirements: Node >= 18, MariaDB (or MySQL compatible), ffmpeg, build-essential for sharp native build.
• After cloning: copy .env.example → .env, set at least MEDIA_DIR, DB_PASS, JWT_SECRET.
• Run bash install.sh for automatic provisioning, or follow manual install steps in README.md.
• Run an initial scan: node cli.js scan or trigger from Admin → Scan.