ZL154/JellyfinSecurity v2.5.2

on GitHub

v2.5.2

Bug fix release. Restores the admin Security Dashboard on Jellyfin 10.11.9+ servers. In-place upgrade — no config / enrollment / OIDC / audit-log changes. 254/254 tests pass.

Fix

• Dashboard "Failed to load dashboard" on Jellyfin 10.11.9 / 10.11.10 (#37) — the Overview endpoint and the security-score "all admins protected" factor both walked _userManager.Users via a statically-bound IL call. Between Jellyfin 10.11.8 and 10.11.9 the return type of IUserManager.Users changed, so a plugin compiled against the 10.11.8 ABI threw System.MissingMethodException: Method not found: 'IEnumerable<User> IUserManager.get_Users()' at runtime on the newer ABI. The dashboard surfaced this as the user-visible "Failed to load dashboard" error and the score endpoint stopped contributing to the overall computation.

  The same reflection-based shim already used by TwoFactorAuthController.EnumerateAllUsers and StatsService.EnumerateUsers now wraps both broken callsites — Type.GetProperty(nameof(IUserManager.Users)).GetValue(_userManager) returns whatever IEnumerable<> shape the running Jellyfin actually exposes, items are downcast to User, and iteration proceeds normally. Bypasses JIT static-binding entirely so the call works against 10.11.8, 10.11.9, 10.11.10, and any future return-type change that still implements IEnumerable.

  Specifically patched:

  • TwoFactorAuthController.GetDashboardOverview admin/regular enrollment count loop
  • SecurityScoreService.AreAllAdminsProtected (factor #2 of the 12-factor security score)

Verification

• 254/254 xUnit tests pass.
• Clean build with TreatWarningsAsErrors=true — 0 warnings, 0 errors.
• The reflection pattern has been in production at the two pre-existing callsites for months across the 10.11.x range — if it didn't work on 10.11.10, the stats and audit endpoints would also be throwing MissingMethodException, and they aren't.

Upgrade

In-place. No config / enrollment migration. Jellyfin 10.11.8 users see no behavioural difference (the reflection call is functionally identical there). Jellyfin 10.11.9 / 10.11.10 users get a working dashboard again.