The dashboard listed every share ever made, including ones revoked or expired
months ago, and nothing ever pruned them. There is now a "Clean up finished links"
button next to Refresh that runs a normal cleanup pass and then drops the records
that are done with, reporting how many went.
Only revoked, expired and failed records are removed. A link that can still be
used is left alone, including a spent one-use link whose guest is still watching
until it expires, since that record is Redeemed rather than finished.
Folded into 1.0.3.0 rather than shipped as 1.0.3.1: the ceiling fix and this are
going out as one replacement of that version.
The ceiling shipped in 1.0.3.0 did the opposite of its job. Jellyfin throws
MediaBrowser.Controller.Net.SecurityException when a user is at their session
limit, and the catch that was meant to handle it named System.Security's type of
the same name, so it never matched. The exception fell through to the failure
path, which marks the record failed and runs cleanup, which deletes the guest
account. Live result with the ceiling at 3: the fourth viewer got a dead-link
page, the three already watching were kicked out, and the link was gone.
Rather than swap one exception type for another and trust it, the over-the-ceiling
viewer is now turned away before anything is written at all: no tag work, no
status change, the guest account untouched. The check mirrors what Jellyfin does
when it creates a session, counting sessions for the guest against the ceiling.
The typed catch stays as a backstop for the race between the check and the call,
and it now names the right type.
A link that has never been redeemed has no guest yet, so it can never be at a
ceiling, and 0 still means no limit.
New setting, ten by default, zero for no limit. Single-use links are unaffected,
they are one viewer by definition.
The catch is what happens at the ceiling. Jellyfin throws SecurityException once a
user is at MaxActiveSessions, and that was landing in the generic handler, which
marks the record failed and runs cleanup, which deletes the guest account. So
without care, adding a ceiling would mean the eleventh person to open a link kicks
out the ten already watching and destroys the link. Capacity is caught separately
now: the record goes back to the state it was in, nothing is torn down, and the
new arrival gets a 503 page inviting them to try again.
Worth being honest that this caps how many people can start watching at once, not
how many ever get in: each redemption issues its own session token that keeps
working until the link is revoked or expires. Revoke is still the hard stop.
README picks up the multi-use option, the new setting, and a section on what a
multi-use link does and does not protect, plus the known limits around the token
in the query string, the unthrottled redeem endpoint, and the tag being hidden in
the web UI only.
The create popup now has a "Let several people use this link" box next to the
expiry controls. Tick it and the link stays redeemable by everyone you send it to
until it expires; leave it and you get the old behaviour, where the first person
to open it is the only one who gets in. The plugin setting that used to be the
only control is now just what the box starts out as, and its label on the config
page says so, because "Default one-use links" explained nothing.
Multi-use did not actually work before this. Two things in Jellyfin stopped it,
and both had to change:
Guests were given MaxActiveSessions = 1, and AuthenticateNewSessionInternal throws
SecurityException once a user is at that limit. The second viewer's redemption
would fail, the record would go to Failed, and cleanup would then delete the guest
account, kicking the first viewer out too. Multi-use links now get 0, which is how
Jellyfin spells "no limit" in that check.
The device id was generated once and reused for every redemption, and
GetAuthorizationToken logs out every existing session for the same user and device
before issuing a token. So even under a raised session cap, each new viewer would
have revoked the previous one's token. Multi-use links now mint a device id per
redemption.
Both viewers of a multi-use link share one temporary account, so they also share
playback position and watched state on the shared title.
The check skipped hiding when the Users/Me lookup came back empty, which is the
one case where we do not know who is looking. Only a positive administrator
verdict skips it now.
The tag has to live in the item's real Tags for Jellyfin's tag policy to confine
the guest, so normal users were seeing a "sharelinks-<guid>" chip on any shared
title and an entry for it in the library tag filter. Admins still see them; for
everyone else the chip is taken back out of the tag row, along with the ", "
Jellyfin puts between chips, and the whole row is hidden when the share tag was
the only one. The tag filter entry gets hidden too.
Only tags matching sharelinks- plus 32 hex are touched, so a real tag that happens
to start with "sharelinks" is left alone. Guests benefit as well, since they were
seeing the tag on the title they were sent.
Worth being clear about the limit: this is the web UI. The tag is still in the API
response, so anyone reading the raw API can see it.
The result of Users/Me was cached in a module level promise for the lifetime of
the page. The web client is a single page app, so signing out or switching
accounts never reloads the document and the script kept whichever user it saw
first. Open the page as an admin, switch to a normal user in the same tab, and
isAdministrator() still said yes: the admin-only ShareLink action was injected
into that user's menus.
The cached user and guest state are now keyed to ApiClient.getCurrentUserId(),
so a switch invalidates them, and a non-admin verdict actively removes any action
left in the DOM by the previous session instead of just declining to add one.
Nothing was reachable through this. The create endpoint checks the Administrator
role server side and answers 403 for a non-admin (confirmed against a real
non-admin session), so the button was there but did nothing.
JellyfinGuestUserService looked up IUserManager methods by reflection, trying
eight candidate signatures for ChangePassword alone, and ItemTagService did the
same for UpdateItemAsync. That fails at runtime on any API drift and only logs a
warning, which is exactly how the DbUpdateConcurrencyException hunt started. We
already pin Jellyfin.Controller 10.11, so these are now plain typed calls and any
future drift is a compile error. 427 lines of shim gone, behaviour unchanged
(UpdateItemAsync still gets ItemUpdateType.None, password still set before the
policy update).
Guest accounts also get their own authentication provider now, which refuses every
interactive sign-in. Redemption is unaffected: AuthenticateDirect passes
enforcePassword false and never consults a provider. If the plugin is disabled the
provider id stops resolving and Jellyfin assigns the account to its own
InvalidAuthProvider, which refuses too, so this fails closed. A random password is
still set as a second line of defence.
Findings from a pass over the plugin, smallest first:
Redemptions now run one at a time behind a gate. The status checks and the status
write that follows them were not atomic, so two requests arriving together with
the same one-use token could both mint a guest session. The spent-link check also
moved above the tagging step, so hammering an already-used link no longer re-tags
a whole series on every hit.
The configured maximum expiry is actually respected. Both the API and the picker
did Math.max(configured, 720), so setting the ceiling to anything under 30 days
was silently ignored. The picker now also hides the quick-pick durations that sit
above the ceiling.
The share URL, which carries the raw token, is dropped from the record when the
link is revoked or expires. Records are never deleted, so dead tokens were
accumulating in the store forever. Live links keep it so the dashboard can still
copy them, and the README claim that no token is ever written to disk is corrected
to say what the code actually does.
The HMAC key file is created 0600 instead of inheriting the default mask.
The button used to be cloned in next to "Copy Stream URL", or shoved at the top
of the menu when there was none, which put it in the middle of Jellyfin's own
command groups. Now there is a single injection path: append an actionsheetDivider
plus the action at the end of the sheet's scroller, so it reads as its own
section the way Jellyfin separates its groups.
It also stopped appearing on menus for things that are not media. The old code
resolved the item from the URL, so opening the "..." menu on a cast member inside
a movie page showed ShareLink and would have shared the movie behind it. The item
is now taken from the trigger that opened the menu (card, list row or the detail
page's own button, all of which we can walk up from) and its type is checked
against the server before anything is injected: movie, series, season, episode,
nothing else. The API refuses everything else too, so a hand-rolled request
cannot tag a person or a playlist either.
Clicking the action now dismisses the action sheet instead of leaving it stacked
under the dialog.
Three problems reported on series shares. The ShareLink action landed
at the bottom of the series menu because the fallback injector cloned
the last item and appended; it now clones the first item and inserts
at the top, matching where it sits for movies. Guests could not open
season or episode pages because guest mode disabled pointer events on
all cards; cards are clickable again, since the server-verified route
check and the tag policy already control where a guest can actually
go. The injected item also inherited the template's data-id, which
could shadow a real menu command like Informations; it is stripped
now.
Sharing a series or season now tags the entire tree (series, seasons,
episodes) so the guest can browse and play everything inside it, and
strips it all again at cleanup. Redeeming re-tags the tree, so episodes
added after the link was created show up on the next redemption. The
guest lockdown in the web client now asks the server whether a page's
item is visible to the guest instead of hard-coding the single shared
id, so guests can navigate inside the shared tree but nowhere else.
Libraries and collections are still rejected.
Bumps the version to 1.0.1.0.
Opening an expired or invalid link used to dump raw problem-details
JSON at the guest. Now they get a small page matching the sign-in
look, with the same neutral wording whether the link expired or never
existed (so tokens cannot be probed by outsiders), and an automatic
redirect to the Jellyfin home page. Fixes#1.
GuestHiddenSelectors now defaults to empty instead of shipping CSS
selectors for a plugin nobody else runs. Existing installs keep their
saved value. Fixes#3.
The old flow encrypted the guest password on disk next to its own key,
then sent it to the guest in the bootstrap HTML anyway. Now redemption
mints the session with ISessionManager.AuthenticateDirect and the page
only ever carries the session token. The guest account still gets a
random password nobody knows, so blank login stays impossible, but no
password is stored or sent anywhere anymore. Cleanup now defaults to
every 30 minutes instead of daily at 4am so expired guests die fast.
The fallback injector matched almost any dialog with a couple of buttons,
so the button leaked into the Edit images and Add to collection dialogs
(both opened from the item menu). Restrict it to genuine action sheets
(.actionSheet / [role=menu]) whose entries are .actionSheetMenuItem and
include a recognizable item command, which also excludes audio/subtitle/
quality pickers. The primary path (next to Copy Stream URL) is unchanged.
Replace the 30-days quick button with a native datetime-local picker
(bounded by the server max) so links can expire on an exact date; the
picked date is converted to whole hours through the existing path.
Localize the creation popup and its toasts to French when the Jellyfin
UI language is French, detected from the html lang attribute like the
sibling plugin does; English is the fallback.
The action-sheet fallback matched any dialog with 2+ buttons, which
caught the Add to Collection dialog and stuck a Create guest link
button next to OK. Skip containers that have a select/text input/
textarea, since real action sheets are just a list of buttons/links.
The CSS data-id selector wasn't reliably hiding the action-sheet item in
guest sessions, so add a JS pass (part of the lockdown refresh) that
matches menu items by data-id, localized visible text, and icon, and
hides them with an inline style. The action sheet is added on menu open,
which the existing mutation observer already picks up.
The movie detail page's Tags section lives in its own .itemTags container,
not inside .detailsGroupItem like genres/studios/cast, so tag chips stayed
clickable for guests. Disable those links too.
The add-to-playlist and add-to-collection entries in the item's "..."
menu render with data-id="playlist"/data-id="addtocollection", not
data-action="addtoplaylist"/"addtocollection" as previously assumed —
that selector matched an unrelated list-row button and never hid the
actual menu items. Target the correct attribute so both are hidden.
Also drop the specific plugin name from the guest-hidden-selectors
description in favor of generic wording; the default selector value
is unchanged.
Rename the injected context-menu action from 'Create guest link' to
'ShareLink' and swap its cloned copy icon (content_copy) for the share
icon, matching the other menu items' style.
Replace the placeholder scaffold README with a user-facing one describing
what the plugin does, the server-side guest confinement, configuration,
and the known Jellyfin cast/crew tag bug (jellyfin/jellyfin#14926).
Hiding .headerBackButton for guests also removed the video player's back
button (same class), so a guest could not return from playback to the
movie page. Stop hiding that class; keep home/drawer/search hidden.
Cast, studio, genre and tag links on the detail page now have
pointer-events disabled for guests so they stay visible but inert
(clicking Studio no longer spins on a page the guest cannot load), and
the add-to-playlist/add-to-collection actions are hidden.
Add a GuestHiddenSelectors config field (comma-separated CSS selectors,
surfaced through GuestState since guests cannot read plugin config) so
other plugins injected UI can be suppressed for guest sessions without
code changes; defaults to hiding the AI Search elements.
Creating a link from a home-page carousel resolved the wrong id: the
card context menu detaches into a body-level action sheet, so the DOM
walk missed the movie and fell back to the first data-id on the page (a
library folder), which then got rejected. Capture the pointed-at card's
item id at pointerdown so the action injects the right id.
Guest lockdown let guests reach the home page: nav was hidden by
matching English label keywords, which never matched the French UI, and
any details/list route counted as allowed. Hide the header
back/home/drawer/search buttons by CSS class instead, and treat only the
guest's own item page (or a playback route) as allowed so off-item
routes redirect back to the shared title.
The sign-in bootstrap sent the auth request body as a JS object, so it
was coerced to [object Object] and AuthenticateByName returned 400. Send
JSON.stringify(...) instead.
Guest credentials were written to localStorage as a flat object under
made-up keys. jellyfin-web reads jellyfin_credentials as
{Servers:[{Id,AccessToken,UserId,...}]}, so the guest was treated as
logged out. Write that shape, pulling server Id/name from
System/Info/Public, and redirect with the 10.11 hash route
(#/details?id=...&serverId=...) instead of the legacy #!/ form that
rendered a blank page.
Creating a link now rejects folders and libraries (only movies and
episodes are shareable) so a guest cannot land on an empty tag-filtered
library. Item ids from the menu action are validated as GUIDs client
side, rejected creates are logged server side, malformed redeem tokens
return 404 instead of 500, and the admin table shows the item name and a
copyable link instead of the raw item id.
Includes fix for redemption failing with DbUpdateConcurrencyException:
change the guest password before applying the user policy, since
UpdatePolicyAsync bumps the user's EF concurrency token and a stale
instance then breaks ChangePassword.
Franciskid