Skip to content

v1.6.0 — Security hardening + i18n + custom toast logo

Choose a tag to compare

View all tags
@ZL154 ZL154 released this 15 Apr 20:15
· 244 commits to main since this release
v1.6.0
b16e1c3

v1.6.0 — Major release

🔒 Security hardening (full pass)

  • IDOR fix — UserOwnershipFilter enforces per-user authorization on all /users/{id}/* routes. Previously any authenticated user could access/modify any other user's data by swapping the route ID. Users are strongly encouraged to update.
  • Profile card — returns 404 for unknown users, GUID validation, no more empty profile materialization on anonymous reads
  • Custom badge / imported profile sanitization — length caps, range clamps, enum validation
  • Webhook URL validator — blocks SSRF (loopback, RFC1918, link-local, ULA, cloud metadata)
  • Client-side XSS — escaped user-controlled strings in shell.js + sidebar.js
  • Input bounds — completionPercent clamped to [0,100], rejects NaN/Infinity
  • Middleware buffer cap — 5 MiB on response buffering
  • Rate limiting — 60/min per user, 30/min per IP (anonymous), prestige 1/hour, recompute 1/5min
  • Audit log username redaction — admin opt-in to store UserId only, never write usernames to disk
  • SECURITY.md — documents CSRF mitigation rationale (Jellyfin's header-token auth structurally prevents it)

Thanks to @xdnewlun1 (Techno Cricket, CCDC) for responsible disclosure of the IDOR + related findings.

🎨 Custom toast logo

Admins can upload an SVG in Feature Controls to replace the default Xbox logo in unlock toasts. Useful for custom server branding.

  • XML-parsing SvgSanitizer (XXE-safe via DtdProcessing.Prohibit)
  • Blocks <script>, <iframe>, <foreignObject>, <use>, <embed>, <object>
  • Blocks on* event handlers, javascript: and data:text/html URIs
  • 100 KB cap, base64 storage

(SvgSanitizer pattern adopted from PR #8 — much better than my regex approach.)

🌍 Internationalization (8 languages)

  • English, Français, Español, Deutsch, Italiano, Português, 中文, 日本語
  • ~220 UI keys per language
  • Admin page translated
  • Badge titles + descriptions for the first ~50 most-common badges localized (Getting Started, Binge, Films, Series, Streaks, Weekend, Night Owl, etc.)
  • Remaining badges fall back to English — community contributions welcome via PR
  • Hot-swap on language change (no page reload)
  • Per-user preference + admin server default
Assets 3
Loading