SergeantPanda 47427d4b0f security: ... - Set `DEFAULT_PERMISSION_CLASSES` to `Authenticated` in the DRF configuration. - Explicitly marked the HDHomeRun discovery endpoints (`DiscoverAPIView`, `LineupAPIView`, `LineupStatusAPIView`, `HDHRDeviceXMLAPIView`) and the version endpoint with `permission_classes = [AllowAny]` to document their intentionally public access now that the global default is `Authenticated`.		2026-04-09 21:36:51 -05:00
..
__init__.py	Initial commit	2025-02-18 11:14:09 -06:00
admin.py	Alpha v3	2025-02-21 15:31:59 -06:00
app_initialization.py	Enhancement: Refactored app initialization to prevent redundant execution across multiple worker processes. Created dispatcharr.app_initialization utility module with should_skip_initialization() function that prevents custom initialization tasks (backup scheduler sync, developer notifications sync) from running during management commands, in worker processes, or in development servers. This significantly reduces startup overhead in multi-worker deployments (e.g., uWSGI with 10 workers now syncs the scheduler once instead of 10 times). Applied to both CoreConfig and BackupsConfig apps.	2026-02-05 13:48:01 -06:00
asgi.py	websockets behind auth, cleaned up errors and bad state handling in websocket.jsx	2025-05-10 08:40:53 -04:00
celery.py	Bug Fix: Version update notification persisting after upgrading to the notified version (e.g. "v0.20.2 available" shown while already running v0.20.2). Root cause: check_for_version_update.delay() was called from AppConfig.ready(), which fires inside Celery prefork pool subprocesses before the broker connection is established, causing the dispatch to fail silently with no log output. Fixed by moving the startup dispatch to the worker_ready signal in celery.py (consistent with the existing recover_recordings_on_startup pattern), and deleting the stale version-{current_version} notification at the top of the production check path so it is cleared even when GitHub is unreachable. A WebSocket update is sent immediately on deletion so the frontend badge clears without waiting for the API response.	2026-03-08 13:38:18 -05:00
consumers.py	Bug Fix: M3U profile URL rewriting now uses the regex module instead of re across all URL transform code paths (url_utils.transform_url, core/views.py, vod_proxy/_transform_url, tasks.get_transformed_credentials, and the WebSocket live-preview handler in consumers.py). The regex module natively accepts JavaScript/PCRE-style named capture groups ((?<name>...)) without any conversion, eliminating the root cause of patterns that matched in the frontend live preview but failed on the backend with a re.error. As a further improvement, regex also supports variable-length lookbehind assertions (e.g. (?<=a+)), which re rejects with an error; patterns using these will now work correctly on the backend as well. Replace-pattern JS tokens are still normalised before calling regex.sub: $<name> → \g<name> and $1/$2/… → \1/\2/… (Python replacement syntax). Also fixed a bug in the WebSocket preview handler where a pattern error was incorrectly returning the search pattern string as the preview output instead of the original URL. (Fixes #1005)	2026-03-29 17:55:08 -05:00
jwt_ws_auth.py	Enhance JWT authentication error handling and user redirection on token issues.	2025-05-15 14:12:31 -05:00
persistent_lock.py	merged in dev	2026-03-26 12:17:43 -04:00
routing.py	Websockets, fixed channel name collision, added back in multi-stream per channel support	2025-03-05 17:04:43 -05:00
settings.py	security:	2026-04-09 21:36:51 -05:00
urls.py	fleshed out user limits and termination logic	2026-03-25 17:33:26 -04:00
utils.py	Enhancement: Updated default network access settings for M3U and EPG endpoints to only allow local/private networks by default (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, ::1/128, fc00::/7, fe80::/10). This improves security by preventing public internet access to these endpoints unless explicitly configured. Other endpoints (Streams, XC API, UI) remain open by default.	2026-01-31 20:26:45 -06:00
wsgi.py	Revert "fix(wsgi): ensure gevent monkey-patching before Django import chain"	2026-03-03 15:33:55 -06:00