github Novik/ruTorrent v5.3.13
on GitHub

5 hours ago

v5.3.13

Security

  • The XMLRPC proxy is hardened and available as a standalone endpoint, with the proxy decision separated from the send (#3188). Client-quoted load.* arguments are preserved instead of dropped, including an escaped comma inside an argument (#3209).
  • The download directory is escaped in the load command string (#3195).
  • Input validation across _task, create, httprpc, rutracker_check, screenshots, tracklabels and trafic (#3185).
  • loginmgr matches a stored account by the URL's host and never below its scheme, so credentials are not offered to a host that merely looks similar (#3205, #3206).
  • Tracker status messages render clickable URLs with sanitization (#3200).

Core

  • Torrent metadata keys are declared instead of created dynamically, a numeric key stored under one spelling reads back under the other, and binary metainfo is no longer probed as a filesystem path (#3213, #3225, #3229).
  • Settings writes are checked against rtorrent's socket allocation limits, the effective limits are reported, and a save that rtorrent rejects is rolled back and reported rather than left half-applied (#3196, #3227).
  • A settings object whose probe failed is no longer cached (#3191).
  • getScheduleCommand starts deterministically (#3199).
  • FileUtil::deleteDirectory() recurses — it previously fataled on any non-empty directory (#3216); both branches of FileUtil::makeDirectory() are braced (#3226).
  • The log file created by toLog() gets $profileMask, log paths and permissions are validated, and a profile mask the configuration could not read is reported instead of silently applied (#3193, #3231, #3233).
  • RU_LOCALHOSTS is read from the same source as the rest of conf/config.php (#3235).
  • httprpc tells the client when a list answer is a full one (#3190) and reports a refused XMLRPC call as a refusal rather than an outage (#3192).
  • unpack treats quotaspace as the optional field it is (#3216).
  • Plugin init.php requires resolve against the file's own directory (#3218).
  • A enabledByDefault flag in plugins.ini, with a shared lookup and a defined meaning for an unset flag (#3197, #3203).

Interface

  • s-table: the delayed draw is fixed and no longer drops row changes (#3189).
  • The RSS and Ratio rules dialogs have distinct titles (#3238).
  • Assorted small UI corrections (#3200).

Plugins

  • check_port: the yougetsignal check works again against its GraphQL API, and the plugin now falls back through a configurable provider chain, with Globalping added as a provider for both IPv4 and IPv6 (#3222, #3245).
  • erasedata: erase requests are queued so a mass erase cannot flood rtorrent (#3240); a ratio group set to remove data now deletes the data of downloads rtorrent never opened (#3187).
  • filedrop: paste a magnet link or torrent URL to add it (#3202).
  • loginmgr: an unavailable cached session is distinguished from a rejected one (#3198).
  • extsearch: ImmortalSeed no longer loses three categories to duplicate array keys; ZamundaNet corrected (#3217).
  • Fixes in cpuload, log_history and the Toloka account handler (#3217).
  • Every bundled plugin declares the PHP extensions it uses, and env_check.php reports which plugins a missing extension would disable or limit (#3242, #3247).

Themes

  • Material Design: placeholder text is legible again — it was rendering at 1.09:1 contrast against the dark field background (#3244).

Localization

  • Every key the interface asks for is defined in every language, and a test keeps it that way (#3210, #3243).
  • The mobile plugin's hard-coded strings are localized across all 28 languages (#3204).
  • check_port ships its previously missing keys (#3241).
  • Greek translations updated.

Development

  • PHPStan level 0 gate in CI, and the tree is at zero findings — including the vendored XMPPHP and JShrink, fixed in place rather than excluded (#3215, #3219).
  • Test coverage for rtorrent 0.16.21 compatibility and the socket allocation gate (#3230, #3236), the scripts that rewrite a torrent (#3212, #3214), and the erasedata queue (#3248).
  • The PHP test harness reports comparisons independently of assertions (#3232).
  • brace-expansion bumped to 1.1.18 (#3220).

GitHub commit-by-commit follows:

What's Changed

  • Misc input validations by @xirvik in #3185
  • ratio: delete the data of downloads a ratio group erases by @xirvik in #3187
  • Harden the XMLRPC proxy and add a standalone endpoint by @xirvik in #3188
  • s-table: fix the delayed draw, and stop it dropping row changes by @xirvik in #3189
  • httprpc: tell the client when the list answer is a full one by @xirvik in #3190
  • Do not cache a settings object whose probe failed by @xirvik in #3191
  • httprpc: report a refused XMLRPC call as a refusal, not an outage by @xirvik in #3192
  • Apply $profileMask to the log file toLog() creates by @xirvik in #3193
  • Escape the download directory in the load command string by @noctuum in #3195
  • Give getScheduleCommand a deterministic start by @IvanShift in #3199
  • Up/small UI by @IvanShift in #3200
  • Say which two things the tracker message separator joins by @xirvik in #3201
  • Add enabledByDefault flag to plugins.ini by @adenwuts in #3197
  • Share the plugins.ini flag lookup and pin what an unset flag means by @xirvik in #3203
  • loginmgr: match an account by the URL's host, and never below its scheme by @IvanShift in #3205
  • loginmgr: match NNMClub by the URL host too by @xirvik in #3206
  • mobile plugin: localize hard-coded strings by @koblack in #3204
  • Check that every localization key the interface asks for exists by @xirvik in #3210
  • httprpc: keep client-quoted load.* arguments instead of dropping them by @xombiemp in #3209
  • Keep an escaped comma inside a load argument by @xirvik in #3211
  • Test what the scripts that rewrite a torrent do to it by @xirvik in #3212
  • Declare a torrent's keys instead of creating them dynamically by @xirvik in #3213
  • Test that a torrent key named like an object field is still a key by @xirvik in #3214
  • Fix the PHPStan level-0 findings in the vendored XMPPHP and JShrink by @xirvik in #3215
  • Fix/deletedirectory and optional quotaspace by @xirvik in #3216
  • Fix/plugin defects by @xirvik in #3217
  • Anchor plugin init.php requires on the file's own directory by @xirvik in #3218
  • Add a PHPStan level 0 gate by @xirvik in #3219
  • build(deps): bump brace-expansion from 1.1.11 to 1.1.18 in /tests by @dependabot[bot] in #3220
  • filedrop: add paste-to-add for magnet links and torrent URLs by @lebowitz in #3202
  • Report the socket allocation limits and check a settings write againt them by @xirvik in #3196
  • Fix check_port_yougetsignal using GraphQL API by @ToshY in #3222
  • check_port: make the yougetsignal answer testable, and send Origin by @xirvik in #3223
  • Restore PHP 7.4 Torrent metadata compatibility by @IvanShift in #3224
  • Read a numeric torrent key back by either spelling by @xirvik in #3225
  • Brace both branches of FileUtil::makeDirectory() by @xirvik in #3226
  • Harden FileUtil log paths and permission handling by @IvanShift in #3231
  • Say when a profile mask could not be read, and pin the log path rules by @xirvik in #3233
  • Report a profile mask the configuration could not read by @xirvik in #3234
  • Read RU_LOCALHOSTS from the source the rest of the file reads by @xirvik in #3235
  • Test rTorrent 0.16.21 compatibility by @IvanShift in #3230
  • Test the rtorrent 0.16.21 socket allocation gate by @xirvik in #3236
  • Avoid probing binary torrent data as filesystem paths by @IvanShift in #3229
  • Make settings saves recover socket allocation failures by @IvanShift in #3227
  • Fix httprpc refusal responses by @IvanShift in #3228
  • Make PHP test failures independent of assertions by @IvanShift in #3232
  • Give the RSS and Ratio rules dialogs distinct titles by @noctuum in #3238
  • Fix/rules dialog nits by @xirvik in #3239
  • loginmgr: distinguish unavailable responses from expired sessions by @IvanShift in #3198
  • check_port plugin: add missing localization keys by @koblack in #3241
  • Define every en.js key in every language, and keep it that way by @xirvik in #3243
  • check_port: add Brazilian Portuguese localization by @chiphead2332 in #3246
  • Material Design: make placeholder text visible by @xirvik in #3244
  • _getdir plugin: require PHP mbstring extensions by @koblack in #3242
  • Declare the PHP extensions the bundled plugins use, and check them by @xirvik in #3247
  • erasedata: queue erase requests so mass erases cannot flood rtorrent by @adenwuts in #3240
  • Cover the erasedata queue, and let it require what it uses by @xirvik in #3248
  • check_port: add provider failover and Globalping by @chiphead2332 in #3245
  • check_port: cover the Globalping verdict with tests by @xirvik in #3249
  • Bump version to 5.3.13 by @xirvik in #3250

New Contributors

Full Changelog: v5.3.12...v5.3.13

Check out latest releases or
releases around Novik/ruTorrent v5.3.13

Don't miss a new ruTorrent release

NewReleases is sending notifications on new releases.

Get notifications