4 Commits

Include renames

Author	SHA1	Message	Date
nathan	36303fecea	Phase 1b/1c: server-side input handling and authentication ... Input handling: - uploadLogo: client file name reduced to a safe base name with an image extension (path traversal and arbitrary-extension writes closed). - extractZIP: zip-slip guard; entries that resolve outside the target are refused. Per-entry closes no longer pile up as defers. - ffmpeg.path / vlc.path must be an existing regular file named ffmpeg, vlc or cvlc, checked both when saved and right before exec. - Stream URLs passed to the external buffer must use a network scheme (http, https, rtsp, rtmp, rtp, udp, mms); file:, concat:, pipe: are refused. - /download/ (backups with settings.json and authentication.json) requires the web session when web authentication is enabled. - settings.json is written 0600; the Plex token is masked in every payload sent to the UI and the mask round-trips as "unchanged" on save. Authentication: - Passwords are stored with bcrypt. Existing HMAC-SHA256 records still verify (constant time) and are re-hashed on the first successful login. Username lookups compare in constant time. - URL (?username=&password=) and HTTP Basic authentication verify the credentials per request via AuthenticateUser and no longer create a session token, which removes the unbounded token growth under Plex polling. Expired sessions are evicted whenever a new one is created. - createFirstUserForAuthentication and checkAuthorizationLevel now return real errors instead of calling no-op closures. Tests: src/security_test.go and src/internal/authentication/ authentication_test.go cover each of the above.	2026-09-26 13:04:54 +10:00
nathan	51c7830067	Phase 0: remove auto-updater, pin Go 1.27.1, fix vet warnings, tidy ignores ... - Delete BinaryUpdate, internal/up2date, GitHub/Update structs and the xteveAutoUpdate / update.url settings (UI rows, en.json, defaults). Settings-schema migrations kept and moved to src/migrate.go. - Drop kardianos/osext dependency. - xteve.go version 0200 -> 0201 to match changelog; Drone now fails on drift. - go.mod go 1.27.1; Dockerfile and Drone golang images pinned to 1.27.1. - Fix four go vet unreachable-code warnings. - .gitignore: .gocache/, agent.md, skill.md. .dockerignore: build context no longer includes caches, ts/, tasks/ or markdown except the changelog. - Drone: publish :latest only from master; other branches publish a branch-named tag so a feature push cannot replace the deployed image. - Add tasks/improvement-plan.md and tasks/todo.md. - Regenerate src/webUI.go.	2026-09-26 12:38:02 +10:00
nathan	43a9cf5a7e	bugfix	2026-02-11 11:52:34 +11:00
xteve-project	e44eff0645	Add go.mod and go.sum. Require go v1.16	2021-03-29 19:47:56 +02:00