Skip to content

2.3.2

Latest
Latest

Choose a tag to compare

View all tags
@primetime43 primetime43 released this 31 Jul 20:19
2.3.2
8ae7b3c

This release focuses on security, import consistency, and reliability.

Security improvements

  • Default source installs now listen only on 127.0.0.1.
  • Remote access requires an RTP_ACCESS_TOKEN of at least 16 characters.
  • Added HTTP Basic authentication for remote connections.
  • Added CSRF and same-origin protection to state-changing API requests.
  • Hardened CSV uploads against path traversal:
    • UUID-based storage filenames
    • Server-side .csv enforcement
    • Required IMDb/Letterboxd header validation
    • 10 MB upload limit
    • Automatic cleanup of old and invalid uploads
  • Removed an HTML injection edge case from preview-card rendering.
  • Clear-rating requests now require a single-use, server-generated confirmation token that expires after 60 seconds.
  • Clearing ratings requires typing the exact library name, or ALL LIBRARIES.
  • A downloadable CSV backup is created before ratings are cleared. The operation aborts if backup creation fails.

Import pipeline improvements

  • Added one shared parse → validate → match → plan → apply pipeline for previews and updates.
  • Preview and update now use identical validation, matching, and planning rules.
  • Removed the duplicated IMDb and Letterboxd import implementations.
  • Removed differing lazy/bulk matching paths that could produce inconsistent results.
  • Applying an import plan no longer performs a second match.
  • Added rating-range validation:
    • IMDb/Plex: 1–10
    • Letterboxd: 0.5–5
  • Plex library scan failures now abort planning instead of incorrectly marking every item as missing.
  • Force-overwrite changes now reload the server-generated preview plan.
  • Improved preview handling for missing IMDb IDs and media-type mismatches.

Reliability and testing

  • Added regression coverage for:
    • Network authentication and CSRF protection
    • Secure file uploads and path traversal
    • Destructive-operation confirmations and backups
    • HTML injection prevention
    • IMDb and Letterboxd pipeline behavior
    • Preview/update write-set parity

Docker upgrade note

Docker deployments must now configure an access token:

docker run \
  -e RTP_ACCESS_TOKEN="choose-a-strong-password" \
  -p 127.0.0.1:5000:5000 \
  primetime43/ratings-to-plex-ratings:latest

When prompted by the browser, use:

- Username: ratings
- Password: the configured RTP_ACCESS_TOKEN

**Full Changelog**: https://github.com/primetime43/Ratings-To-Plex-Ratings/compare/2.3.1...2.3.2

**Full Changelog**: https://github.com/primetime43/Ratings-To-Plex-Ratings/compare/2.3.1...2.3.2
Assets 2
Loading