leepeuker/movary 0.78.0

on GitHub

Breaking changes:

• Plex and Jellyfin server URLs pointing to private, reserved, or loopback addresses must now be explicitly permitted using PLEX_URL_ALLOWLIST or JELLYFIN_URL_ALLOWLIST. The allowlists accept exact hostnames, IP addresses, and CIDR ranges. Connections are restricted to HTTP(S) on ports 80, 443, 8096, 8920, and 32400, and redirects are no longer followed. Public server destinations do not require allowlisting.
• REST API clients can no longer exchange email and password credentials for an expiring token. API requests must now use a personal API token created in account settings. Existing personal tokens and the X-Movary-Token header remain supported; tokens can also be supplied using Authorization: Bearer.

Password policy update: New and changed passwords must contain at least 15 Unicode characters. Existing passwords remain valid until they are changed or reset.

This release also adds management for multiple personal API tokens, support for displaying and searching by original movie titles, improved poster layouts, and additional security hardening (thanks for reporting security vulnerabilities goes to @Hama1cco, @tonghuaroot and @hackchang).

What's Changed

• Feature: Add personal API token management by @leepeuker in #868
• Feature: Add Bearer REST API authentication by @leepeuker in #869
• Feature: Improve poster UI layouts by @leepeuker in #871
• Feature: Store and optionally display original movie titles by @leepeuker in #881
• Fix: Adjust integration documentation links by @leepeuker in #875
• Fix: Correctly process leading-zero TOTP codes by @leepeuker in #876
• Maintenance: Move browser API calls to web routes by @leepeuker in #862
• Maintenance: Add explicit authentication results by @leepeuker in #863
• Maintenance: Migrate web authentication callers by @leepeuker in #864
• Maintenance: Memoize request authentication by @leepeuker in #867
• Maintenance: Document job processing by @leepeuker in #873
• Maintenance: Fix PHPUnit deprecations by @leepeuker in #874
• Security: Restrict API authentication to personal tokens by @leepeuker in #865
• Security: Make login web-session-only by @leepeuker in #866
• Security: Prevent caching sensitive responses by @leepeuker in #882
• Security: Raise and centralize password policy by @leepeuker in #883
• Security: Harden Jellyfin and Plex URL validation against SSRF with DNS pinning and configurable allowlists by @leepeuker in #884

Full Changelog: 0.77.0...0.78.0