CI Report:
https://ci-tests.linuxserver.io/linuxserver/tautulli/develop-8c715c5a-ls491/index.html
LinuxServer Changes:
No changes
Remote Changes:
Restrict guest history to the session user
Intersect the session user filter instead of widening it.
get_datatables_history merged the session user id into a caller's
user_id clause. A guest asking for user_id=1 got
user_id IN ('1','2'), a union of both users, when the session user has
to narrow the result. The session clause is now appended on its own and
ANDed with whatever the caller asked for.
Reject a guest asking for another user's id in get_history.
/api/v2?cmd=get_history&user_id=<other> had no allow_session_user
guard, unlike its siblings. It now returns an empty datatables result.
Impact. A logged-in guest read any other user's full history through
the API or the history table: titles, player, IP address and username.
recordsFiltered, filter_duration and total_duration were computed
over the other user's rows as well. The user parameter never leaked,
because that clause was already ANDed with the session user.
Admin sessions are unaffected. get_session_user_id returns a value only
when user_group is guest.
Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01NKPVebjGmEVfhrPPRm4jQq