Security
- A wrong encryption key no longer destroys stored credentials. Kima keeps a credential it cannot read and treats it as not set, so restoring the right key brings it back, and saving other settings in the meantime loses nothing.
- A Lidarr webhook secret Kima can no longer read now refuses unsigned events, and Kima gives Lidarr a new secret by itself on its next health check.
- Password guessing is capped whatever address a client claims. Web login and Subsonic each allow 20 wrong passwords per 15 minutes per username, counted separately. App keys and signed-in sessions keep working on a locked account.
- Linking a device now needs your approval. A right code no longer hands a device its key by itself: the device waits while you approve or deny it on the link page, which shows its name. A guessed code gets nothing.
- A shared link now shows only what the share page needs. Playlist and track shares now return a short, named list of fields instead of whole database rows.
- A pasted music link must really be on the music site. Links have to be http or https on a supported site or one of its subdomains, on every import path, and the downloader's catch-all fallback is off.
- A link pasted without https:// says so. The import page and the browse page's paste box now answer "Paste the full link, starting with https://" instead of a generic error.
- A Soulseek file name can only point inside the downloads folder. With slskd, a name that would lead outside it now fails that download, which names the peer, and Kima tries the next source.
Removed
- Bandcamp links can't be imported any more. The downloader stopped being able to read Bandcamp pages, so these imports were failing anyway.
Quick start
docker run -d \
--name kima \
-p 3030:3030 \
-v /path/to/your/music:/music \
-v kima_data:/data \
chevron7locked/kima:v1.12.4Then open http://localhost:3030 and create your account. See the README for full documentation.
Full Changelog: v1.12.3...v1.12.4