Exact

Exact Union RegExp

SergeantPanda 6cd6d3ef9a Enhancement: - **Output bitrate DB persistence**: the ffmpeg_output_bitrate stat is no longer written to the database on every FFmpeg stats tick (~2/second). Instead, a local exponential moving average (EMA, α=0.1) accumulates readings continuously. The first 10 samples (~5 seconds) are discarded as warmup to avoid polluting the average with FFmpeg's unstable ramp-up values. After warmup, the smoothed value is flushed to the database at most once every 30 seconds, and a final flush occurs when the stream stops but only if the EMA has been seeded (i.e. the stream ran past warmup). Streams that stop during warmup leave the existing database value untouched, preserving previously accurate measurements when channel-hopping.		2026-04-16 17:15:54 -05:00
..
accounts	security: Extended rate limiting to the session-auth login alias (POST /api/accounts/auth/login/). It now delegates entirely to TokenObtainPairView, inheriting its throttle, network access check, and audit logging, and returns JWT tokens instead of a session cookie (the session-based response was unusable since SessionAuthentication is not in DEFAULT_AUTHENTICATION_CLASSES). Both endpoints share the same "login" throttle scope, so attempts across either path count against the same per-IP limit.	2026-04-10 19:54:10 -05:00
api	initial connect feature	2026-02-08 09:29:22 -05:00
backups	security: Fixed path traversal vulnerability in file uploads. The M3U account upload (apps/m3u/api_views.py), logo upload (apps/channels/api_views.py), and backup upload (apps/backups/api_views.py) all used the uploaded filename directly without sanitization. os.path.join() discards all preceding components when it encounters an absolute path segment, and pathlib's / operator behaves identically; a relative ../ sequence also escapes via OS path resolution at open() time. All three upload paths now strip directory components via Path(name).name and validate the resolved path remains within the intended upload directory. Exploiting any of these required admin credentials.	2026-04-09 21:32:36 -05:00
channels	fix: clear previous failure entries after successful logo fetch in LogoViewSet and VODLogoViewSet	2026-04-14 13:34:17 -05:00
connect	Bug Fix: Fixed several incorrect or incomplete OpenAPI (@extend_schema) schemas across the API	2026-04-11 17:02:07 -05:00
dashboard	modified database fields for consistency, removed custom_url from streams (no longer needed)	2025-03-16 09:07:10 -04:00
epg	performance:	2026-04-16 13:19:19 -05:00
hdhr	security:	2026-04-09 21:36:51 -05:00
m3u	Enhancements:	2026-04-11 14:57:52 -05:00
output	performance:	2026-04-16 13:19:19 -05:00
plugins	fix(migration): Fix plugin repo migration that specified AutoField for id instead of BigAutoField.	2026-04-14 16:36:16 -05:00
proxy	Enhancement: - **Output bitrate DB persistence**: the ffmpeg_output_bitrate stat is no longer written to the database on every FFmpeg stats tick (~2/second). Instead, a local exponential moving average (EMA, α=0.1) accumulates readings continuously. The first 10 samples (~5 seconds) are discarded as warmup to avoid polluting the average with FFmpeg's unstable ramp-up values. After warmup, the smoothed value is flushed to the database at most once every 30 seconds, and a final flush occurs when the stream stops but only if the EMA has been seeded (i.e. the stream ran past warmup). Streams that stop during warmup leave the existing database value untouched, preserving previously accurate measurements when channel-hopping.	2026-04-16 17:15:54 -05:00
vod	fix: clear previous failure entries after successful logo fetch in LogoViewSet and VODLogoViewSet	2026-04-14 13:34:17 -05:00