Skip to content

v1.7.6

Latest
Latest

Choose a tag to compare

View all tags
@ShaneIsrael ShaneIsrael released this 08 Aug 14:38
v1.7.6
7889e7f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security Fix

Update recommended if you use password-protected videos.

What was wrong

  • When auth checking password protected videos nginx and the auth check parsed the request URL differently, and the auth check allowed requests against URL's it couldn't parse.

What's fixed

  • nginx now passes the video ID it already resolved directly to the auth check - one parser, no mismatch.
  • The auth check now denies requests it can't resolve instead of allowing them.
  • URLs are decoded and normalized before matching, and matching is now case-insensitive.

Not affected

  • Videos without a password (unchanged - private still means link-only, as documented).
  • Thumbnails, screenshots, and normal playback all behave as before.

Full Changelog: v1.7.5...v1.7.6

Assets 2
Loading