Deluan 9dd306eb10 fix(artwork): enforce entity visibility on the Subsonic getCoverArt path ...

serveEntity reads persisted item_artwork by id, bypassing the library and private-
playlist filters that the legacy entity-load applied. On the authenticated Subsonic
path a user could fetch artwork for an inaccessible album or someone else's private
playlist by guessing an id. getCoverArt now resolves the underlying entity through
the request-scoped (filtered) repositories and serves the placeholder when it is not
visible, so existence isn't leaked and the always-an-image invariant holds. The
public share (JWT-authorized) and Jellyfin (admin) paths are intentionally untouched.

2026-07-23 14:08:08 -04:00

..

e2e

chore(artwork): generic 500 bodies on refresh endpoint, trim stale test comments

2026-07-23 14:08:08 -04:00

responses

feat(subsonic): add OpenSubsonic work and movement attributes (#5659)

2026-06-24 09:10:00 -04:00

album_lists_test.go

feat(subsonic): add sonicSimilarity extension as plugin capability (#5419)

2026-04-27 17:50:09 -04:00

album_lists.go

feat(jellyfin): experimental Jellyfin Music API support (#5730)

2026-07-14 11:46:37 -04:00

api_suite_test.go

refactor(lyrics): single ParseLyrics entry point + all-format plugin lyrics (#5632)

2026-06-19 18:25:35 -04:00

api_test.go

fix(share): enforce per-user ownership on share reads

2026-06-05 15:50:59 -04:00

api.go

feat(server): serve artwork from persisted state with content-hash caching

2026-07-23 14:08:08 -04:00

bookmarks.go

refactor(server): drop redundant error return from req.Strings parsing (#5812)

2026-07-18 19:30:04 -04:00

browsing_test.go

feat(subsonic): content-hash coverArt ids, omit artwork on known-absent

2026-07-23 14:08:08 -04:00

browsing.go

feat(subsonic): content-hash coverArt ids, omit artwork on known-absent

2026-07-23 14:08:08 -04:00

helpers_test.go

feat(subsonic): content-hash coverArt ids, omit artwork on known-absent

2026-07-23 14:08:08 -04:00

helpers.go

feat(subsonic): content-hash coverArt ids, omit artwork on known-absent

2026-07-23 14:08:08 -04:00

jukebox.go

refactor(server): drop redundant error return from req.Strings parsing (#5812)

2026-07-18 19:30:04 -04:00

library_scanning_test.go

fix(subsonic): require admin access for Subsonic management endpoints (#5510)

2026-05-19 14:23:38 -03:00

library_scanning.go

refactor(server): drop redundant error return from req.Strings parsing (#5812)

2026-07-18 19:30:04 -04:00

lyrics_test.go

fix(scanner): stop logging expected lyrics sniff misses as warnings (#5702)

2026-07-02 09:46:57 -04:00

lyrics.go

fix(subsonic): emit agent-specific cueLine values (#5679)

2026-06-28 18:14:18 -04:00

media_annotation_test.go

feat(playlists): per-user starred/rating annotations (backend) (#5749)

2026-07-14 07:38:25 -04:00

media_annotation.go

refactor(server): drop redundant error return from req.Strings parsing (#5812)

2026-07-18 19:30:04 -04:00

media_retrieval_test.go

fix(artwork): enforce entity visibility on the Subsonic getCoverArt path

2026-07-23 14:08:08 -04:00

media_retrieval.go

fix(artwork): enforce entity visibility on the Subsonic getCoverArt path

2026-07-23 14:08:08 -04:00

middlewares_test.go

fix(subsonic): require admin access for Subsonic management endpoints (#5510)

2026-05-19 14:23:38 -03:00

middlewares.go

fix(subsonic): require admin access for Subsonic management endpoints (#5510)

2026-05-19 14:23:38 -03:00

opensubsonic_test.go

feat(subsonic): add structured sidecar lyrics support with OpenSubsonic v2 karaoke cues and agent layers (#5076)

2026-06-19 12:00:58 -04:00

opensubsonic.go

feat(subsonic): add structured sidecar lyrics support with OpenSubsonic v2 karaoke cues and agent layers (#5076)

2026-06-19 12:00:58 -04:00

playlists_test.go

feat(subsonic): content-hash coverArt ids, omit artwork on known-absent

2026-07-23 14:08:08 -04:00

playlists.go

feat(subsonic): content-hash coverArt ids, omit artwork on known-absent

2026-07-23 14:08:08 -04:00

radio_test.go

feat(subsonic): content-hash coverArt ids, omit artwork on known-absent

2026-07-23 14:08:08 -04:00

radio.go

feat(subsonic): content-hash coverArt ids, omit artwork on known-absent

2026-07-23 14:08:08 -04:00

searching_test.go

feat(subsonic): content-hash coverArt ids, omit artwork on known-absent

2026-07-23 14:08:08 -04:00

searching.go

feat(subsonic): content-hash coverArt ids, omit artwork on known-absent

2026-07-23 14:08:08 -04:00

sharing.go

refactor(server): drop redundant error return from req.Strings parsing (#5812)

2026-07-18 19:30:04 -04:00

sonic_similarity.go

feat(subsonic): add sonicSimilarity extension as plugin capability (#5419)

2026-04-27 17:50:09 -04:00

stream.go

fix(transcoding): cap concurrent transcodes to prevent ffmpeg DoS (#5522)

2026-05-24 00:24:30 -03:00

system.go

…

transcode_test.go

fix(streaming): surface why a transcode decision failed (#5820)

2026-07-19 18:51:32 -04:00

transcode.go

fix(streaming): surface why a transcode decision failed (#5820)

2026-07-19 18:51:32 -04:00

users_test.go

refactor: rename EnableCoverArtUpload to EnableArtworkUpload

2026-03-27 19:33:46 -04:00

users.go

refactor: multiple syntax updates for Go 1.26

2026-05-19 18:02:36 -03:00