v4.1.30 — tags can be merged and deleted, Kobo finally sees your series edits, and two security fixes

docker pull ghcr.io/new-usemame/calibre-web-nextgen:v4.1.30

Tag tidy-up arrives, metadata edits reach your Kobo, books waiting in the ingest folder at startup get imported, and two security holes are closed.

Read this first if you use a reverse proxy

One of the security fixes below refuses writes that claim to come from another website. Your proxy has to tell the server both the address you use and whether the connection is https. A proxy that terminates TLS but forwards no X-Forwarded-Proto leaves the server thinking the request arrived over plain http, and writes are refused even though the address matches.

Most proxies do this correctly out of the box, and if http:// links have never turned up in your emails or redirects, you are almost certainly fine. If writes start failing after this update, pick any one of these:

• forward X-Forwarded-Host and X-Forwarded-Proto
• set the existing PROXY_HOST and PROXY_SCHEME
• name the address you actually use in the new optional CWNG_TRUSTED_ORIGINS (comma-separated)

Nothing is needed for a normal install.

Tags can be merged and deleted

Renaming a tag onto a near-duplicate — "Sci-Fi" onto "SciFi", which is how you merge two into one — was refused with "A tag with that name already exists", so consolidating them was impossible, and there was no way to delete a tag at all. The rename now tells you which tag it clashed with and how many books that one has, then offers to merge into it; the books move across and the leftover tag disappears. Delete removes a tag from every book that carries it and keeps the books. Both are on the Tags list so you can spot near-duplicates side by side, and both ask before they change anything. Reported by @magdalar.

Series and other metadata edits now reach your Kobo

Setting a series name and number saved fine in the library and showed in the web interface, but the book on the Kobo still had no series. Books converted for Kobo are stored as .kepub files, and those were the one format the metadata writer skipped, so every edit reached the .epub while the file your reader actually opens was left untouched. .kepub files are now written too. Existing books pick this up the next time you edit them, or in one pass from Settings if you run the cover and metadata enforcement over the whole library. Reading positions and bookmarks already on your reader are preserved. Clearing a field is not covered yet and is tracked in #1376. Reported by @bjekel.

Books waiting in the ingest folder at startup are imported

Copy files in while the server is stopped, reboot the host mid-copy, or restart with an import still pending, and the book simply never arrived: no error, nothing in the log, and restarting did not help. The only way out was to touch or re-copy every file. The folder is now swept once at startup, and books left in the retry queue by a previous run are picked back up too.

Security: writes are refused when they come from another website

Every change the new interface makes already had to carry a one-time token that a page on another site cannot read, but if one were ever obtained the server would have carried out the write without noticing the request came from somewhere else. It now checks the whole /api/v1 surface at once, rather than route by route, so a new endpoint inherits the check instead of having to opt in. Tools like curl and native clients that send no such information keep working, and OPDS, Kobo and KOReader sync are on separate paths and are unaffected.

Security: the Statistics page no longer shows your server version to everyone

It listed the exact release, the host kernel build, the Python build and the version of every library the server uses — around 70 entries — to any visitor who could open the page, including people not signed in at all where guest browsing is on. That is enough detail to look up known vulnerabilities for the exact software you are running. Those details now go to admins only, and the server withholds them rather than just hiding them on the page. Book, author, series and category counts are unchanged for everyone. Reported by @kabili207; @chloeroform sent the first fix and the page-side change.

---

Something still broken? Open an issue or come by Discord.