new-usemame/Calibre-Web-NextGen v4.1.65

v4.1.65: OPDS and app-password fixes for reading apps, and a sign-in fix behind some proxies

on GitHub

docker pull ghcr.io/new-usemame/calibre-web-nextgen:v4.1.65

Mostly OPDS and app-password fixes for reading apps, plus a sign-in fix for one common proxy setup and a support pack that hides more.

Fixed

• Signing in and creating app passwords no longer hang behind a proxy that sends Connection: upgrade on every request. A common nginx and Nginx Proxy Manager WebSocket snippet sets that header for all traffic, and the web server then waited on the raw connection for the request body until the proxy returned a 504. Requests are now always read as ordinary HTTP. Thanks to @nkfs for the report. (#2838)
• /api/v1 reads honour an app password sent over HTTP Basic. The right username and app password now read the library, shelves and /api/v1/auth/me as that account instead of the guest view (or a 401 with anonymous browsing off). Account settings and admin pages still need a signed-in session. A wrong password gets 401. Browsers keep their session, and a reverse proxy that adds its own Basic login in front of CWNG does not sign anonymous visitors out. (#2844)
• OPDS no longer serves a wrong password as the guest. With anonymous browsing on, wrong credentials now get 401 rather than the guest catalog, so a reader app's connection test fails when it should. No credentials, or an empty username, still gets the guest catalog. If your proxy passes its own Basic login through to /opds, either use matching CWNG credentials there or drop the Authorization header for /opds. (#2844)
• OPDS thumbnails are thumbnails. /opds/thumb_240_240, /opds/cover_240_240 and /opds/cover_90_90 now send the generated JPEG thumbnail instead of the full cover, and feed cover links carry a version so apps can cache them until the cover changes. /opds/cover still sends the original. (#2845)
• OPDS search finds "C++". The catalog now advertises /opds/search?query=<term>, where a plus survives. /opds/search/<term> still works. (#2846)
• OPDS search results come in pages at the Books per page setting, with next and previous links that keep the term and language. (#2847)
• Desktop compatibility mode no longer recounts every Magic Shelf on every request. Counts are kept until metadata.db changes on disk, so a book added in Calibre desktop still shows up on the next request. Thanks to @JALindsay4444, who found the cause. (#2862)

Security

• The sanitised support pack no longer leaks Kobo sync tokens, email addresses or account names. They are replaced with consistent labels (<email_1>, <user_1>), so one account can still be followed through the pack. If account names cannot be read, SANITIZED.txt says so.

Full changelog: CHANGELOG.md