None df7e6422df perf: eliminate three remaining N+1 queries in list endpoints ... Layered on top of the prior perf commits, removes additional per-row queries Channel list (apps/channels): add auto_created_by to select_related so ChannelSerializer.get_auto_created_by_name does not fire one SELECT per row. Replace instance.streams.all().order_by(channelstream__order) in to_representation with a read off the prefetched channelstream_set. M3U account list (apps/m3u): prefetch_related "filters" on the viewset queryset and sort filters in Python over the prefetch in M3UAccountSerializer.get_filters. Frontend (EditableCell.jsx): align the saveValue useCallback dependency from [row.original.id] to [row.original] in the Number, Group, EPG, and Logo cells, matching the pattern applied to the Text cell.		2026-05-02 16:48:37 -05:00
..
accounts	security: Extended rate limiting to the session-auth login alias (POST /api/accounts/auth/login/). It now delegates entirely to TokenObtainPairView, inheriting its throttle, network access check, and audit logging, and returns JWT tokens instead of a session cookie (the session-based response was unusable since SessionAuthentication is not in DEFAULT_AUTHENTICATION_CLASSES). Both endpoints share the same "login" throttle scope, so attempts across either path count against the same per-IP limit.	2026-04-10 19:54:10 -05:00
api	initial connect feature	2026-02-08 09:29:22 -05:00
backups	security: Fixed path traversal vulnerability in file uploads. The M3U account upload (apps/m3u/api_views.py), logo upload (apps/channels/api_views.py), and backup upload (apps/backups/api_views.py) all used the uploaded filename directly without sanitization. os.path.join() discards all preceding components when it encounters an absolute path segment, and pathlib's / operator behaves identically; a relative ../ sequence also escapes via OS path resolution at open() time. All three upload paths now strip directory components via Path(name).name and validate the resolved path remains within the intended upload directory. Exploiting any of these required admin credentials.	2026-04-09 21:32:36 -05:00
channels	perf: eliminate three remaining N+1 queries in list endpoints	2026-05-02 16:48:37 -05:00
connect	Enhancement: VOD start/stop notifications and system events.	2026-04-23 18:03:02 -05:00
dashboard	modified database fields for consistency, removed custom_url from streams (no longer needed)	2025-03-16 09:07:10 -04:00
epg	Bug Fix: EPG channel name vlaue too long for type character varying(255) (Fixes #1134)	2026-04-21 09:23:35 -05:00
hdhr	rename Channel.user_hidden to Channel.hidden_from_output	2026-05-01 19:44:16 -05:00
m3u	perf: eliminate three remaining N+1 queries in list endpoints	2026-05-02 16:48:37 -05:00
output	rename Channel.user_hidden to Channel.hidden_from_output	2026-05-01 19:44:16 -05:00
plugins	Enhancement: Improve plugin discovery process by adding a completion flag and refining in-memory registry handling	2026-04-30 10:33:41 -05:00
proxy	Enhancement: Update user connection reporting in xc_get_info to reflect active connections and max connections based on user stream limits. (Fixes #990)	2026-04-30 20:33:30 -05:00
vod	fix: clear previous failure entries after successful logo fetch in LogoViewSet and VODLogoViewSet	2026-04-14 13:34:17 -05:00