Writing the tag into index.html on disk fails on most fresh installs
(linuxserver image, distro packages, Docker as a normal user) because
the web files belong to root. A middleware now adds the tag to the
response instead, so the ShareLink action and the guest lockdown work
right after install. The on-disk edit stays as a best-effort extra, and
the tag uses a relative src so it also works under a base URL.
Bump to 1.0.8.0.
* block plugin routes for share guests
Adds a global MVC filter that refuses share-guest accounts on any plugin
controller. Jellyfin's own API stays open, the share tag policy already
bounds it and playback needs it.
Guests are identified by the auth provider marker on the account, so this
covers a leaked token used from curl or a native client, not just the web
client where the CSS lockdown runs.
* add plugin exception list and honest wording
Config page lists installed plugins with a checkbox each, for the ones that
need to answer guests during playback. Default is unticked.
Renames the hidden selectors setting to say it is cosmetic, and stops the
readme implying the web client lockdown confines anything.
* bump to 1.0.4.0
JellyfinGuestUserService looked up IUserManager methods by reflection, trying
eight candidate signatures for ChangePassword alone, and ItemTagService did the
same for UpdateItemAsync. That fails at runtime on any API drift and only logs a
warning, which is exactly how the DbUpdateConcurrencyException hunt started. We
already pin Jellyfin.Controller 10.11, so these are now plain typed calls and any
future drift is a compile error. 427 lines of shim gone, behaviour unchanged
(UpdateItemAsync still gets ItemUpdateType.None, password still set before the
policy update).
Guest accounts also get their own authentication provider now, which refuses every
interactive sign-in. Redemption is unaffected: AuthenticateDirect passes
enforcePassword false and never consults a provider. If the plugin is disabled the
provider id stops resolving and Jellyfin assigns the account to its own
InvalidAuthProvider, which refuses too, so this fails closed. A random password is
still set as a second line of defence.
Includes fix for redemption failing with DbUpdateConcurrencyException:
change the guest password before applying the user policy, since
UpdatePolicyAsync bumps the user's EF concurrency token and a stale
instance then breaks ChangePassword.
Francois CB
Franciskid