Security Release
This release fixes vulnerabilities that let any logged-in user delete or read arbitrary files on the server and take over an admin session. All users should upgrade.
Security fixes
- File management (/file/**) is now limited to content managers. Before, any logged-in user could delete arbitrary files on the server through /file/removeFileFromDisk.
- /file/save no longer accepts file paths from the client. Before, any logged-in user could register any file on the server (including the H2 database) and download it through /file/serve.
- Remember-me cookies are no longer signed with a key that shipped with Streama. Each install now generates its own key on first start (streama-remember-me.key in the working directory). You can still set grails.plugin.springsecurity.rememberMe.key yourself.
- Users could read and change other users' viewing status (#1170).
After upgrading, everyone has to log in once more, because existing remember-me cookies were signed with the old key.
Docker users: rebuild your image, docker/Dockerfile downloads the latest release.
Credit: Hama1cco
Features
v1.11.1 was never published, so these ship with this release:
- Episode thumbnails in the player's episode selector
- Episode cards show the available audio and subtitle languages
- Subtitles are picked automatically based on the user's language
- FFmpeg audio transcoding for codecs browsers can't play (EAC3, AC3, DTS)
- Last login timestamp in user settings
Fixes
- Migrated from the deprecated OpenSubtitles.org API to the OpenSubtitles.com API v1