I-IAL9000/shrinkerr v0.3.28

on GitHub

Security

Phase 1 of a security hardening pass — closes the most severe findings from the internal audit. No breaking changes for existing installs; a few previously permissive defaults tighten up on fresh installs.

Fixed

• Auth middleware no longer fails open when the settings DB read raises — returns 503. A transient SQLite lock could previously disable auth for the whole process.
• Auth middleware now enforces when a non-empty api_key is configured, independent of the auth_enabled flag. The old behaviour gated only when password auth was toggled on, so setting a key without flipping the toggle left the app wide open.
• api_key is masked (****xxxx) in /api/settings/encoding GET, matching every other stored secret. Dedicated GET /api/settings/api-key returns the unmasked key on demand for the Settings → System page and the copy-to-clipboard button.
• Integration endpoints (/api/webhooks/*, /api/nodes/*, /api/settings/backup/{download,restore}, /api/settings/nzbget-config, /api/settings/{nzbget,sabnzbd}-script) always require an API key — even when auth_enabled=false. Previously a LAN-exposed install handed out RCE-adjacent primitives to anyone who could reach port 6680.
• /api/settings/dirs POST now validates the path: must be absolute, must be an existing directory, must not be the filesystem root or under /etc, /root, /proc, /sys, /boot, /dev, /app/data. Stops an attacker bypassing every downstream containment check by adding "/" as a media directory.
• backup_folder setting validated the same way. Stops the conversion pipeline from being coerced into renaming originals into privileged directories.
• /api/scan/delete-file containment check rewritten with Path.resolve() + os.path.commonpath — the old startswith check was defeatable by "/media/../etc/hostname" (literally starts with /media/).
• /api/webhooks/{scan,queue} and /api/jobs/add-by-path now verify every supplied path resolves inside a configured media directory before running ffprobe/ffmpeg.

Added

• Fresh installs auto-generate a strong api_key + session_secret and enable password auth on first startup. The generated key is printed once, prominently, to the container logs.
• Existing installs with both api_key="" and auth_enabled=false now get a loud [SECURITY] warning banner on every startup so the operator knows they're running unauthenticated.

Docker images

Pinned to this release:

docker pull ghcr.io/i-ial9000/shrinkerr:0.3.28         # portable (amd64 + arm64, CPU)
docker pull ghcr.io/i-ial9000/shrinkerr:0.3.28-nvenc   # x86_64 + NVIDIA GPU (NVENC)
docker pull ghcr.io/i-ial9000/shrinkerr:0.3.28-edge    # as above but ffmpeg master
docker pull ghcr.io/i-ial9000/shrinkerr:0.3.28-edge-nvenc

Floating tags (:latest, :edge, :nvenc, :edge-nvenc) track the most recent release of each lineage.