Security Release
This release fixes a vulnerability that exposed the configured TheMovieDB and OpenSubtitles API keys to every logged-in user, and to visitors without an account when anonymous access is enabled. All users should upgrade.
Security fixes
- /settings/index (settings.json) returned all settings to any logged-in user, including the TheMovieDB and OpenSubtitles API keys and server paths. With anonymous access enabled, anyone could read them after opening the login page. Users who are not admins now only get the settings the UI needs, admins still get all of them (#1176).
If your instance had anonymous access enabled, or has users you don't fully trust, rotate your TheMovieDB and OpenSubtitles API keys after upgrading.
Docker users: rebuild your image, docker/Dockerfile downloads the latest release.
Found by Liam Giannini.