tylerbcrawford/subgeneratorr v3.4.0

v3.4.0 — cross-site request guard, translation source fix and resume, language-aware missing-subtitle scan

on GitHub

A security and correctness release. It closes a cross-site request hole in the default (no-auth) setup, fixes translations being made from an earlier translation, and makes the missing-subtitle scan follow your language.

Security

• Cross-site requests can no longer drive the API. With authentication off (the default for local use), a web page open in the same browser could post to localhost:5000 and queue transcription, keyterm or translation jobs, because five endpoints parsed any request body as JSON whatever its content type. Requests that change something must now send Content-Type: application/json, and anything a browser marks as cross-site is refused.
• Responses now carry X-Content-Type-Options, Referrer-Policy and X-Frame-Options: SAMEORIGIN.
• ollama_host is checked on keyterm generation and translation as well as on the model list, so the worker only ever calls a bare host:port.

Fixed

• Translating from a translation. With more than one subtitle next to a video, the source was whichever file sorted first by name, so Movie.ara.srt (an earlier translation) was used instead of Movie.eng.srt. The source is now the subtitle in your transcription language, never one of the languages you are translating into, and the result message names the file it used.
• Leaked temp files. A file descriptor leaked on every transcription job, and the temporary audio file was left behind when ffmpeg failed or a job was cancelled.
• Sideways scrolling on mobile. The main card could be dragged left and right on phones.

Changed

• "Missing subtitles" follows your language. An embedded subtitle track in a different language than the one selected no longer counts as existing subtitles, and forced tracks never count. A film with only an embedded Spanish track now shows up as missing English subtitles. Untagged tracks still count, and Auto-detect and Multi-language accept any track. Expect library scans to list more files than before.
• Quick Start needs no clone. The example compose files pull the published images instead of building. From a clone, docker compose up -d --build still builds from source.
• Removed the unused /api/progress stream and two settings that did nothing: SECRET_KEY and BAZARR_BASE_URL/BAZARR_API_KEY. Leftover values in .env are ignored.

Added

• Translation resumes after a failure. A run that stops partway (rate limit, timeout, cancelled job) picks up after the last finished batch of cues next time, so translation you already paid for is not redone.
• RESULT_EXPIRES_DAYS (default 7): how long batch status and library-scan results, including the CSV export, stay available. It was one day.
• JOB_LOG_KEEP (default 1000): per-job logs are pruned to the newest N instead of growing without limit.
• SUBGENERATORR_VERSION in the example compose files pins the image tag.

Upgrading

Pull :3.4.0 (or :latest, :3.4) and recreate the web and worker containers. Three things to check:

• Scripts that call the API must send Content-Type: application/json on every POST/PUT, or they get 415. The keyterm CSV upload still uses multipart/form-data.
• Dashboards that embed the UI in an iframe from another origin (Organizr, Homepage) need FRAME_OPTIONS= (empty) in .env, forwarded to the web container.
• If you copied an example compose file before this release, it still builds from source and keeps working. Copy the new one if you would rather pull images.

See CHANGELOG.md for details.