primetime43/Ratings-To-Plex-Ratings 2.3.2

on GitHub

This release focuses on security, import consistency, and reliability.

Security improvements

• Default source installs now listen only on 127.0.0.1.
• Remote access requires an RTP_ACCESS_TOKEN of at least 16 characters.
• Added HTTP Basic authentication for remote connections.
• Added CSRF and same-origin protection to state-changing API requests.
• Hardened CSV uploads against path traversal:
  • UUID-based storage filenames
  • Server-side .csv enforcement
  • Required IMDb/Letterboxd header validation
  • 10 MB upload limit
  • Automatic cleanup of old and invalid uploads
• Removed an HTML injection edge case from preview-card rendering.
• Clear-rating requests now require a single-use, server-generated confirmation token that expires after 60 seconds.
• Clearing ratings requires typing the exact library name, or ALL LIBRARIES.
• A downloadable CSV backup is created before ratings are cleared. The operation aborts if backup creation fails.

Import pipeline improvements

• Added one shared parse → validate → match → plan → apply pipeline for previews and updates.
• Preview and update now use identical validation, matching, and planning rules.
• Removed the duplicated IMDb and Letterboxd import implementations.
• Removed differing lazy/bulk matching paths that could produce inconsistent results.
• Applying an import plan no longer performs a second match.
• Added rating-range validation:
  • IMDb/Plex: 1–10
  • Letterboxd: 0.5–5
• Plex library scan failures now abort planning instead of incorrectly marking every item as missing.
• Force-overwrite changes now reload the server-generated preview plan.
• Improved preview handling for missing IMDb IDs and media-type mismatches.

Reliability and testing

• Added regression coverage for:
  • Network authentication and CSRF protection
  • Secure file uploads and path traversal
  • Destructive-operation confirmations and backups
  • HTML injection prevention
  • IMDb and Letterboxd pipeline behavior
  • Preview/update write-set parity

Docker upgrade note

Docker deployments must now configure an access token:

docker run \
  -e RTP_ACCESS_TOKEN="choose-a-strong-password" \
  -p 127.0.0.1:5000:5000 \
  primetime43/ratings-to-plex-ratings:latest

When prompted by the browser, use:

- Username: ratings
- Password: the configured RTP_ACCESS_TOKEN

**Full Changelog**: https://github.com/primetime43/Ratings-To-Plex-Ratings/compare/2.3.1...2.3.2

**Full Changelog**: https://github.com/primetime43/Ratings-To-Plex-Ratings/compare/2.3.1...2.3.2