Release v5.3.14 · Novik/ruTorrent

Claude's summary, see Github's below.

Security

The raw XMLRPC pass-through now reads one policy at both entry points. rpc2.php and the httprpc plugin loaded separate copies of $XMLRPCProxySafeParams, and only the standalone endpoint's copy allowed d.open, d.close, d.start and d.stop — so a client sending stop-all or resume-all as a multicall was served through one door and refused by rtorrent through the other. plugins/httprpc/action.php now loads conf/xmlrpc_proxy.php before the plugin conf, which still overrides it where it sets something, and a tree with no policy at all says so in the log instead of silently stripping every command parameter. (#3251)

Core

The XMLRPC size limit is asked for on its own, and at a size rtorrent accepts. It used to travel inside the batch that reads the download directory, session path, library version, host name, port range, bind address and IP. rtorrent 0.16.22 refuses a limit above the SCGI content size, and that one refusal discarded every reading in the batch: an empty libTorrent version, an unresolved user, the daemon's default port, and autotools, xmpp and rutracker_check disabling themselves with an empty session path. The value asked for is now 16777216, which is the transport's own ceiling on every supported version, so the limit rises from the 524288 default instead of being refused. (#3257, #3260)

Plugins

History: deleting records from the context menu now respects "Confirm when deleting" and asks first, as the Delete key already did. (#3253)

Themes

Sort indicators point the right way again in Oblivion, OblivionBlue, MaterialDesign and DarkBetter, where an ascending column showed a down arrow and a descending one an up arrow. (#3255)

Development

A check that no shipped function signature spells a nullable parameter implicitly, so the PHP 8.4 deprecation cannot return. (#3252)
Both entry points' trust decisions are now covered by tests that drive the copied production files, plus a guard against a second copy of the safe-parameter policy reappearing. (#3251)
The editorconfig lint job downloads a pinned checker. Its wrapper asked for a release asset name that upstream renamed, which failed the job on every branch regardless of content. (#3258)
browserslist 4.24.4 → 4.28.9 in the test tooling. (#3259)

What's Changed

Read one XMLRPC proxy policy at both entry points by @xirvik in #3251
Add a check for implicitly nullable parameters by @xirvik in #3252
Pin the editorconfig-checker download in CI by @xirvik in #3258
Fix inverted sort icons in Oblivion, OblivionBlue, MaterialDesign and DarkBetter themes by @Randrage in #3255
build(deps-dev): bump browserslist from 4.24.4 to 4.28.9 in /tests by @dependabot[bot] in #3259
Ask for the XMLRPC size limit outside the settings batch by @noctuum in #3257
Ask for an XMLRPC size limit rtorrent accepts by @xirvik in #3260
history plugin: Fix context menu delete confirmation by @koblack in #3253
Bump version to 5.3.14 by @xirvik in #3261

Full Changelog: v5.3.13...v5.3.14