ShaneIsrael/fireshare v1.7.6

on GitHub

Security Fix

Update recommended if you use password-protected videos.

What was wrong

• When auth checking password protected videos nginx and the auth check parsed the request URL differently, and the auth check allowed requests against URL's it couldn't parse.

What's fixed

• nginx now passes the video ID it already resolved directly to the auth check - one parser, no mismatch.
• The auth check now denies requests it can't resolve instead of allowing them.
• URLs are decoded and normalized before matching, and matching is now case-insensitive.

Not affected

• Videos without a password (unchanged - private still means link-only, as documented).
• Thumbnails, screenshots, and normal playback all behave as before.

Full Changelog: v1.7.5...v1.7.6