SergeantPanda 883390308b Merge pull request #1214 from sv-dispatcharr/feat/restrict-xc-user-access ... restrict XC access per user by IP & CIDR allowlist		2026-05-03 15:41:37 -05:00
..
accounts	bump MAX_CUSTOM_PROPS_SIZE to 100KB	2026-05-01 19:15:45 -04:00
api	initial connect feature	2026-02-08 09:29:22 -05:00
backups	security: Fixed path traversal vulnerability in file uploads. The M3U account upload (apps/m3u/api_views.py), logo upload (apps/channels/api_views.py), and backup upload (apps/backups/api_views.py) all used the uploaded filename directly without sanitization. os.path.join() discards all preceding components when it encounters an absolute path segment, and pathlib's / operator behaves identically; a relative ../ sequence also escapes via OS path resolution at open() time. All three upload paths now strip directory components via Path(name).name and validate the resolved path remains within the intended upload directory. Exploiting any of these required admin credentials.	2026-04-09 21:32:36 -05:00
channels	Enhancement: Implement targeted stream-stats refresh for channel table using a new lightweight delta endpoint	2026-04-30 17:46:49 -05:00
connect	Enhancement: VOD start/stop notifications and system events.	2026-04-23 18:03:02 -05:00
dashboard	modified database fields for consistency, removed custom_url from streams (no longer needed)	2025-03-16 09:07:10 -04:00
epg	Bug Fix: EPG channel name vlaue too long for type character varying(255) (Fixes #1134)	2026-04-21 09:23:35 -05:00
hdhr	Security: Implement network access checks for HDHomeRun discovery endpoints and remove dangerouslySetInnerHTML from M3U Profile regex preview to prevent XSS vulnerabilities	2026-04-30 14:03:30 -05:00
m3u	Refactor: Simplify orphaned channel deletion and optimize M3UAccount fetching in send_m3u_update	2026-04-30 16:11:37 -05:00
output	Merge pull request #1214 from sv-dispatcharr/feat/restrict-xc-user-access	2026-05-03 15:41:37 -05:00
plugins	Enhancement: Improve plugin discovery process by adding a completion flag and refining in-memory registry handling	2026-04-30 10:33:41 -05:00
proxy	Merge pull request #1214 from sv-dispatcharr/feat/restrict-xc-user-access	2026-05-03 15:41:37 -05:00
vod	fix: clear previous failure entries after successful logo fetch in LogoViewSet and VODLogoViewSet	2026-04-14 13:34:17 -05:00