4e6e71687b
fix(plex): strip X-Plex-Token on cross-host redirect
...
The Plex integration used bare http.Client values with no CheckRedirect
policy, so they followed redirects automatically. net/http strips the
standard sensitive headers on a cross-host redirect but not custom-named
headers, so the Plex token carried in X-Plex-Token was forwarded verbatim
to any host the configured PLEX_HOST redirected to, disclosing the
credential.
Route all Plex outbound calls through a shared client whose CheckRedirect
policy deletes X-Plex-Token when the redirect target host differs from the
original request host. Includes a regression test.
Signed-off-by: tonghuaroot <tonghuaroot@gmail.com >
2026-07-26 01:27:30 +00:00
8c8d604bc6
v4.1.1-dev1
2026-07-26 01:34:45 +01:00
a16c769273
v4.1.0
2026-07-19 14:15:42 +01:00
f022dc702c
v4.1.0-dev1
2026-07-18 13:05:20 +01:00
9b64932af1
watched_refine: refineFilterStatus: Remove parenthesis around WHERE query.
...
It looks like GORM already adds the parenthesis around this for us in the final query, so ours was unnecessary
2026-07-18 09:50:53 +00:00
bf0594c1e8
Fix Include Previously Watched regression and update profile stats to not use the setting
...
Index also added to
Fixes https://github.com/sbondCo/Watcharr/issues/1027
2026-07-18 09:50:53 +00:00
61382de4d2
v4.0.1
2026-07-16 10:07:58 +01:00
e65ba9d1d9
v4.0.1-dev1
2026-07-16 09:40:47 +01:00
6654d85448
testing workflow - no longer testing workflow cuz it works now yippee
2026-07-16 08:36:22 +00:00
eabdb47cfa
testing workflow - gofmt
2026-07-16 08:36:22 +00:00
643ca0fd38
testing workflow - go test
2026-07-16 08:36:22 +00:00
38fba0ac10
Watched: Also log the error on the "failed to restore existing watched entry" log.
2026-07-16 08:36:22 +00:00
5bebb754ed
v4.0.0
2026-07-11 03:28:19 +01:00
c8920c911d
migrate: Change debug log to info
...
and add an info migration not been applied before log.
2026-07-11 03:27:31 +01:00
dd0bae137f
migrations: Remove comment TODO
...
Should be okay with them there.
2026-07-10 22:08:04 +01:00
d5baee0df7
v4.0.0-dev1
2026-07-10 21:42:03 +01:00
05f9813be8
image: validate: Don't log whole image config
2026-07-10 20:30:23 +00:00
f285d1a8f4
image: Move new download/save methods to a Saver struct
2026-07-10 20:30:23 +00:00
4cc9bd3edb
make image module way more robust
...
- Create a better (more) re-usable flow for downloading images to disk and inserting images into the db
- Validate images properly by reading them fully and using DecodeConfig
- Fix some security issues by re-encoding images
- Always outputs one format `jpeg`, which keeps everything "normalized" and adds compression to images (mainly user uploads which might be big).
2026-07-10 20:30:23 +00:00
34f7f54e72
fix: Add headers to requests for files in img/ folder to prevent stored xss attacks
...
A modern browser will see these headers and protect the user by not allowing any code to run.
2026-07-10 20:30:23 +00:00
3461a4ec74
db: Add duration to log for optimization queries
2026-07-05 17:39:42 +00:00
dbfc354353
GetWatchedPage: Put filter scope on one line
2026-07-05 17:39:42 +00:00
28a6d85672
Update watched.go
2026-07-05 17:39:42 +00:00
b861cfcec3
separate watched_refine funcs
2026-07-05 17:39:42 +00:00
08e0021535
refineSort: Filter by user_id AND use count_as_play instead of doing text search for LastFinished sort
2026-07-05 17:39:42 +00:00
b3bf111f82
Replace Fatal log with more direct Error and os.Exit
2026-07-05 17:39:42 +00:00
23ed5ffca8
Add separator log for log files so a new server starting is easier to find/notice
2026-07-05 17:39:42 +00:00
cc9f246c9a
update watched_util_test with new model name
2026-07-05 17:39:42 +00:00
75d75248e1
Remove AddActivity endpoint
...
it isn't used and is only a way for others to potentially add activity to other peoples watched entries since user owning the watched entry is not validated on the endpoint.
Co-Authored-By: Dreddy <24421368+dredsen@users.noreply.github.com >
2026-07-05 17:39:42 +00:00
c34a0878b2
New Deref helper for using pointers safely with default values
2026-07-05 17:39:42 +00:00
681212566b
activity: Change AddRequest name to Props. Add CountAsPlay param to AddActivity()
...
and some formatting
2026-07-05 17:39:42 +00:00
df37de00e1
manually validate WatchedUpdateRequest struct and add plays count to watcheddto
2026-07-05 17:39:42 +00:00
fc900d8e93
db: Optimize when opening and new optimize task ran every 24hr server is running to keep it running best
2026-07-05 17:39:42 +00:00
57ce143ebe
migrate db to WAL journal_mode
2026-07-05 17:39:42 +00:00
3eb2810a31
db: Configure sqlite connection when open. Currently set synchronous to FULL
...
(did this work a long time ago now so commits are in weird order)
2026-07-05 17:39:42 +00:00
b8598ba404
Remove deleted_at columns for watched episode/season tables
...
We don't use these columns and won't in the foreseeable future. Query speed seems be to be faster now that we aren't filtering for the extra deleted_at cols.
2026-07-05 17:39:42 +00:00
579428d86b
migrate: Backfill media plays data from existing activity
2026-07-05 17:39:42 +00:00
4da8730b6f
Activity: Add CountAsPlay property
2026-07-05 17:39:42 +00:00
e980a1f70e
db: Create custom migrations support
2026-07-05 17:39:42 +00:00
f73105e9c7
v3.0.2-dev1
2026-03-19 01:30:26 +00:00
a12faf8e72
v3.0.1
2026-03-09 11:14:19 +00:00
eb1b8b86c7
v3.0.1-dev2
2026-03-09 10:48:51 +00:00
664caa6ba2
v3.0.1-dev1
2026-03-09 09:14:26 +00:00
e4e015daf8
age->GetAge: If we don't have a birthday skip processing
...
Otherwise eg: we get current year - 1 as someones age if their birthday isn't listed on tmdb
2026-03-09 07:01:22 +00:00
d379d3f147
igdb: Fix some logs, only log req on Debug because it could be sensitive
2026-03-09 03:34:57 +00:00
ac8d8769af
import: Support games importing
...
Fixing watcharr import from watcharr export not importing users games.
Also works if user edits the table in import/process to change the type of something to a game (and multi results works too).
Added warning message if user tries importing a watcharr export that has games when `!serverFeatures.games`
2026-03-09 03:34:57 +00:00
7a7bd4f566
jellyfin sync: Fix addWatched params formatting
2026-03-06 18:33:12 +00:00
ca82a36d23
sync: Update err soft deleted comments
2026-03-06 18:33:12 +00:00
1e6a97202b
tag: GetTagPage: Remove debug call
2026-03-06 18:33:12 +00:00
0e54a8c44a
sync: Fix already on list handling by using new add watched func AND no longer auto restore soft deleted records
...
no longer auto restoring soft deleted records means if the user (soft) deletes a show (default behavior), the next sync job wont add it back.
2026-03-06 18:33:12 +00:00
tonghuaroot
IRHM