Deluan Quintão 043de7a86c

docs(jellyfin): correct the rationale for the public image endpoint (#6114) ...

The comment justified anonymous access with "item ids are unguessable".
That is not true: an artist id is a deterministic, unsalted hash of the
artist name, id.NewHash(id.NewHash(str.Clear(lower(name)))), so it is
computable offline by anyone who knows the name.

The real reason the route is public is that upstream Jellyfin's is too.
ImageController.GetItemImage carries no [Authorize] attribute (verified on
v12.0, master/13.0.0, v10.11.9 and v10.10.7), and an anonymous request
reaches LibraryManager.ItemIsVisible with a null user, which returns true
unconditionally. Clients build cover URLs with no credentials at all, so
requiring auth here would break them.

No behavior change.

2026-09-09 10:42:54 -04:00

..

backgrounds

fix: assorted scanner, plugin, and server fixes from the Go 1.27 work (#6050)

2026-08-30 21:24:50 -04:00

events

fix(ui): activity Indicator switching constantly between online/offline (#5054)

2026-02-17 14:47:20 -05:00

filter

perf(genre): index genre filtering via join tables across all APIs (#5940)

2026-08-11 08:00:50 -04:00

imghttp

feat(artwork): new artwork pipeline with background resolution and Low Quality Image Placeholders (#5847)

2026-08-09 15:03:27 -04:00

jellyfin

docs(jellyfin): correct the rationale for the public image endpoint (#6114)

2026-09-09 10:42:54 -04:00

nativeapi

feat(ui): add Refresh Metadata to the album and artist context menus (#6036)

2026-08-25 23:59:40 -04:00

public

fix(plugins): build public URLs on the caller's address instead of localhost (#6059)

2026-08-31 21:27:43 -04:00

subsonic

fix(subsonic): update the playlist changed timestamp when renaming a smart playlist (#6082)

2026-09-03 16:07:53 -04:00

testdata

fix(server): improve error message for encrypted TLS private keys (#4742)

2025-11-28 17:08:34 -05:00

auth_test.go

feat(jellyfin): non-expiring, audience-scoped tokens revocable by password change (#6013)

2026-08-22 20:36:24 -04:00

auth.go

feat(jellyfin): non-expiring, audience-scoped tokens revocable by password change (#6013)

2026-08-22 20:36:24 -04:00

initial_setup_test.go

Upgrade Ginkgo to V2

2022-07-26 16:53:17 -04:00

initial_setup.go

fix(transcoding): include ffprobe in MSI and fall back gracefully when absent (#5326)

2026-04-07 20:11:38 -04:00

middlewares_test.go

fix(plugins): build public URLs on the caller's address instead of localhost (#6059)

2026-08-31 21:27:43 -04:00

middlewares.go

fix(plugins): build public URLs on the caller's address instead of localhost (#6059)

2026-08-31 21:27:43 -04:00

serve_index_test.go

feat(ui): replace UI scrobble with reportPlayback and redesign NowPlaying panel (#5448)

2026-05-01 15:27:32 -04:00

serve_index.go

fix(ui): Set Cache-Control: no-cache on index.html - #5766 (#5767)

2026-07-12 12:25:23 -04:00

server_suite_test.go

Rename log.LevelCritical to log.LevelFatal

2022-12-21 14:53:36 -05:00

server_test.go

ci: run Go tests on Windows (#5380)

2026-04-19 13:16:47 -04:00

server.go

chore(deps): bump golangci-lint to v2.10.0 and suppress new gosec false positives

2026-02-17 09:28:42 -05:00

throttle_backlog_test.go

fix(test): prevent flaky deadlock in throttle backlog test (#5474)

2026-05-06 11:03:11 -04:00

throttle_backlog.go

chore: go fix

2026-05-28 22:13:05 -03:00