motioneye-project/motioneye 0.45.0b1 on GitHub

Breaking changes

The global validate_certs option in motioneye.conf has been removed. All HTTPS connections made by motionEye now verify server certificates. Certificate verification can instead be switched off individually, for remote motionEye cameras, FTPS/WebDAV/S3 upload services, webhooks, and email notifications, where a self-signed certificate is used. A leftover validate_certs line only causes a one-time startup warning. SMTP server certificates for email notifications with TLS enabled were never validated before. If your setup relies on this, e.g. a mailserver with self-signed certificate, or entered by IP, you need to switch off the new "Verify certificate" toggle now:
The display preferences (layout columns/rows, fit frames vertically, framerate/resolution dimmers, camera order) are now stored per browser, instead of server-side in prefs.json, which is no longer used nor included in backups. Every browser starts with default values once. By default, the number of layout columns now follows the window width, and the single-column layout below 1200px is gone:
- #3502 @JamBalaya56562
- Taken over from #1570 @digiltd
The obsolete update and version API endpoints, and the Server HTTP response header, have been removed:
- #3367 @MichaIng
The additional sections/configs machinery, tzctl/wifictl, and the pushConfigReboot option have been removed, which were unused:
- #3466 @MichaIng
motion does not log to file by default anymore. A new log_to_file setting has been added, which defaults to false, and is honored by motionEye as well as motion. It is overridden by the -l CLI flag, and enabled as well when running motionEye in daemon mode via -b flag. By default, motion logs to syslog/journal now, or STDERR if no syslog is available, e.g. to docker logs in Docker containers. Since motion does not log custom event command output to syslog, if needed for "Run a command", without file logging, output needs to be handled in a script. For the common motioneye.service setup, /var/log/motioneye is now unused, and could be removed:
- #3394 @JamBalaya56562
- #3465 @MichaIng
Failed logins are now rate-limited per client, across usernames. After five failed attempts, further logins are delayed, starting at 5 seconds and doubling up to 15 minutes, and a 429 response with a wait message is shown. If motionEye runs behind a reverse proxy, set the new trusted_proxies option in motioneye.conf, otherwise all users share the proxy's address:
- d00f8a8 @Marijn0
The meyectl sendmail and meyectl sendtelegram commands now only take the motion camera ID and event timestamp. For motion notifications, which internally make use of these commands, access information and credentials are read from the camera config files instead. This way, they do not appear in the meyectl command line and debug motion.log anymore. Camera configurations are migrated automatically on motionEye start for this change, but any custom scripts making use of these commands might need to be adjusted:
- #3426 @free-cup-holder-exe
When adding a camera from a remote motionEye instance, the local hub won't follow redirects anymore. Assure to use the final URL for network cameras on the remote. A new wiki page has been added to describe the remote motionEye feature, changes, and compatibility between motionEye versions:
- df9d70e @free-cup-holder-exe
- https://github.com/motioneye-project/motioneye/wiki/Remote-motionEye-Cameras @free-cup-holder-exe

New features

Authentication for the motion control interface can now be enabled via the new motion_control_authentication option (username:password) in motioneye.conf. For this to be safe, motioneye_init now installs motioneye.conf as root:motion with mode 0640, so motionEye can read but not change it:
- #3474 @JamBalaya56562
- #3475 @JamBalaya56562
The FTP upload service has a new "Use TLS (FTPS)" switch:
- #3472 @free-cup-holder-exe
New "remove files after upload" option for upload services:
- #3374 @JamBalaya56562
New eventstart and eventend actions, and buttons in the camera GUI to trigger motion events and toggle motion detection:
- #2691 @clavay
- #3468 @MichaIng
The order of cameras in the live view can now be customized:
- #3418 @Marijn0
The session lifetime of the normal (surveillance) user is now configurable:
- #3410 @Marijn0
- #3510 @JamBalaya56562
12-hour/AM-PM strftime specifiers (%I, %p, %l) can now be used in file names:
- #3377 @JamBalaya56562
The resolution of HTTP network cameras can be set with motion 4.4+:
- #3461 @Marijn0
motionEye can now be installed more easily into a Python venv, via the new --meyectl option of motioneye_init, which is now the default documented installation method:
- #3496 @JamBalaya56562
motionEye in our official Docker images does not run as root user anymore. The desired user can instead be passed with docker run --user, and the Docker Compose user key respectively:
- #3484 @JamBalaya56562
Added FreeBSD support: local drives are listed using geom, and motioneye_init now installs an rc.d service script:
- #3508 @JamBalaya56562
- Taken over from #1616 @ascl00
motionEye Docker images for ppc64le and s390x are provided on Docker Hub and the GitHub Docker Registry now:
- #3463 @MichaIng

Enhancements

Webhooks now send a User-Agent header:
- #3378 @JamBalaya56562
Media files are now passed on relative to the camera dir, and mounted drives are listed even without write access:
- #3379 @JamBalaya56562
- #3380 @JamBalaya56562
Camera settings are refused when no storage device is available, and an unmounted local disk does not break the settings anymore:
- #3448 @JamBalaya56562
- #3449 @JamBalaya56562
The camera list is now loaded faster, by asking remote cameras at the same time, and errors reported by remote motionEye instances are handled as failures:
Telegram notifications are now sent out faster, by limiting the requested list of pictures to the event time span. Pictures are sent sorted, with oldest first, and sending the message is retried once on failure if no data could be sent:
Event commands are logged to syslog, where motion mutes them:
- #3456 @free-cup-holder-exe
Notifications are sent even when the picture listing fails:
- #3413 @free-cup-holder-exe
Translations are embedded into the page, avoiding a delayed page load:
- #3431 @free-cup-holder-exe
Passwords which are set are no longer sent to the frontend, instead of being masked:
- #3433 @free-cup-holder-exe
Motion is now tracked by its process instead of a PID file. /var/run/motioneye is hence not needed anymore in the common motioneye.service setup:
- #3478 @JamBalaya56562
Some config handling is more tolerant: unparsable commands, other netcam_params entries, and camera configs lacking newer upload settings no longer cause failures:
Camera lists are now filtered by user role, so normal users only see the camera fields they need:
- #3389 @Marijn0
MJPEG stream URLs are now withheld until the user has logged in, and the live view starts automatically after login:
- #3405 @Marijn0
The upload services state file is now created with 0600 permissions:
- #3453 @MichaIng
Requests from a remote (peer) motionEye can no longer read or change the main configuration:
- #3429 @Marijn0
A motionEye hub now treats everything a remote motionEye or a camera sends as untrusted:
- Camera names and messages are shown as plain text, and the remote camera id is validated.
- Remote JSON answers are checked, and redirects from a remote are rejected.
- Remote zip and timelapse downloads are only accepted with known types, and remote movies are cached per camera and path.
- Error messages are sanitized, and the storage webhook URL is now validated like the other webhook URLs.
- Cookies are read by their exact name, and every response now carries X-Content-Type-Options: nosniff.
- 0e09e21 @free-cup-holder-exe
- df9d70e @free-cup-holder-exe
Camera names are now shown as plain text when settings are applied and in the camera frame:
- f2295be @Buff3st-0v3rfl0w @MichaIng

Fixes

The Google Drive upload service has been fixed: Obtaining an authorization key was not possible, since Google blocked the intended redirect. The steps are now outlined on the motionEye dialog, and imply copying the URL address from the browser tab after being redirected by Google:
- #3512 @JamBalaya56562
Using a different listen address than 0.0.0.0 and 127.0.0.1 does not break the motionEye relay API anymore:
- #3469 @Rober1208
Mask editing now uses whole-pixel rectangles and builds the grid at the capture size. This solves an issue where the masked drifted on every load/save cycle:
- #3470 @Rober1208
- #3495 @JamBalaya56562
v4l2 cameras now show boolean controls and use correct control names, and a failed control listing is warned about and not cached:
- #3391 @Marijn0
- #3407 @Marijn0
Boolean netcam_params are translated correctly:
- #3385 @MichaIng
Admin-only camera settings are preserved when omitted from a save:
- #3483 @Marijn0
- #3490 @JamBalaya56562
A failed-connection placeholder is no longer stored as a remote camera's settings:
- #3480 @free-cup-holder-exe
Camera tests report MJPEG connection errors, check RTSP Basic credentials, and no longer fail with a timeout exception:
- #3443 @free-cup-holder-exe
- #3444 @free-cup-holder-exe
- #3445 @free-cup-holder-exe
Saving email notification settings with an empty From address works again, an email is no longer reported as failed when closing the SMTP connection fails, and the test mail no longer raises a second exception on SMTP errors:
- #3408 @Marijn0
- #3381 @JamBalaya56562
- #3450 @MichaIng
Dropbox access test has been fixed:
- #3376 @JamBalaya56562
The upload test success message no longer contains a stray object:
- #3473 @free-cup-holder-exe
Timelapse movies now apply the configured framerate:
- #3437 @Marijn0
An unknown log_level no longer enables debug logging:
- #3427 @free-cup-holder-exe
Python 3.14 fix: the fork multiprocessing start method is kept:
- #3416 @free-cup-holder-exe
CIFS mounts no longer trigger an ntlm kernel warning:
- #3373 @JamBalaya56562
Media dialog playback handlers no longer stack up:
- #3382 @JamBalaya56562
UI fixes: layout rows fit the window again, action buttons are arranged properly with the camera overlay shown, and a camera in error keeps its aspect ratio:
- #3485 @JamBalaya56562
- #3504 @JamBalaya56562
- #3491 @JamBalaya56562
Mask files are written to the configured conf_path:
- #3492 @JamBalaya56562
Removing old media files lists each folder once, and stops at the target dir when removing empty folders. This speeds up the old media files cleanup job significantly:
- #3454 @free-cup-holder-exe
- #3507 @JamBalaya56562
The movie cache dir is created when caching, instead of on import:
- #3509 @JamBalaya56562
A manual motion detection change is kept until the schedule changes:
- #3506 @JamBalaya56562
Camera configs now record the motionEye version which saved them, so migrations can be done based on the previous motionEye version, rather than on every startup:
- #3501 @free-cup-holder-exe

Other changes

The pause setting of motion 4.4+ is used now if motion detection is disabled, which avoids an additional API request at motionEye start, and assures that no motion event can be triggered during the early startup sequence:
- #3372 @MichaIng
- #3386 @MichaIng
Tests and CI/CD: hub/remote compatibility checks across motionEye versions, new tests, CI updates, and regular pre-commit autoupdates:
Code quality, typing, and linter/Bandit annotations, removal of unnecessary imports and shell=True calls:
Background cleanup moved from a process loop to tasks, with follow-up enhancements:
Frontend: inline scripts and handlers moved out of the templates, a CSP response header is now set to guard against XSS, and list_media can filter by time window:
- #3435 @free-cup-holder-exe
- #3414 @free-cup-holder-exe
Camera configs are migrated after logging is configured:
- #3436 @free-cup-holder-exe
Documentation: README now covers Docker images and motioneye_init, Docker build section fixed:
As always: several translations have been updated. Many thanks to all @weblate contributors! ❤️