CI Report:
https://ci-tests.linuxserver.io/linuxserver/bazarr/development-v1.6.3-beta.11-ls22/index.html
LinuxServer Changes:
No changes
Remote Changes:
From newest to oldest:
- Fixed indexed subtitle path check to reverse path mappings before lookup, since the UI sends mapped local paths while the index stores Sonarr/Radarr-side paths 768a525
- Restricted subtitles contents and PATCH endpoints to files indexed by Bazarr, including sync references, to prevent reading or modifying arbitrary files on disk d84777c
- Fixed update checker not offering releases on deprecated Python, handled PlexAuthError in Plex OAuth PIN check, and returned 400 for unparseable subtitle files in contents endpoint 747b036
- Replaced deprecated semver.compare() with semver.Version.parse().compare() in update checker 4be2ce2
- Standardized path traversal protection by using Path.is_relative_to() with realpath consistently across all file serving endpoints e6c247e
- Fixed path traversal vulnerability in backup download endpoint by replacing string prefix check with Path.is_relative_to() method 884bdf3
- Added comprehensive test suites for API endpoints, process control, update checker, health checks, scheduler, and SignalR clients 614327c
- Replaced deprecated Flask-RESTX API decorators 55fb341
- Added comprehensive test suites for API authentication, file path handling, and Plex OAuth security including token encryption and CSRF protection 88ee74a
- Fixed security vulnerabilities: API key validation bypass, path traversal in subtitle contents endpoint, and CSRF state mismatch handling in Plex OAuth; improved URL encoding in Sonarr/Radarr filesystem APIs 4bd2925
- Added comprehensive tests for Sonarr/Radarr notifications, root folder sync, autopulse webhook, language parsing, and subtitle upgrade scoring logic ded9fb8
- Fixed mount point detection and config insertion in autopulse webhook to handle leading slashes correctly and ensure rewrite sections are added before next section header 2c38839