Writing the tag into index.html on disk fails on most fresh installs
(linuxserver image, distro packages, Docker as a normal user) because
the web files belong to root. A middleware now adds the tag to the
response instead, so the ShareLink action and the guest lockdown work
right after install. The on-disk edit stays as a best-effort extra, and
the tag uses a relative src so it also works under a base URL.
Bump to 1.0.8.0.
On linuxserver/jellyfin the web folder belongs to root, so copying
index.html to index.html.sharelinks.bak threw even when index.html itself
was writable, and the ShareLink action never got injected. The backup is
best-effort now.
Bump to 1.0.7.0.
The sign-in page stored the guest's server entry with LastConnectionMode 1
(Remote) but only a ManualAddress. jellyfin-web 12 builds its ApiClient from
that entry, gets no address, throws "Must supply a serverAddress" and never
leaves the splash screen. Store mode 2 (Manual), which is what jellyfin-web
itself writes after a normal sign-in.
Also hide the Modern layout header links, user menu and drawer toggle for
guests (Modern is the default in 12), and close the item action sheet on
desktop when ShareLink opens its popup. Escape only closes it in the TV
layout, a click on the dialog container works everywhere.
Bump to 1.0.6.0.
Jellyfin 10.11.9 changed IUserManager.ChangePassword to take the user id
instead of the User. A call compiled against either signature throws
MissingMethodException on the other, so look up whichever one the server
has and call it through a delegate. Bumps to 1.0.5.0.
Jellyfin does not cascade a user delete to the Device rows redemption
creates, and DeviceManager throws for the whole listing when one device's
user is missing, so a single leftover guest 404s the dashboard devices page.
Deletes the guest's devices before the user, and sweeps devices this plugin
created whose user is already gone at startup for links torn down by older
builds.
* block plugin routes for share guests
Adds a global MVC filter that refuses share-guest accounts on any plugin
controller. Jellyfin's own API stays open, the share tag policy already
bounds it and playback needs it.
Guests are identified by the auth provider marker on the account, so this
covers a leaked token used from curl or a native client, not just the web
client where the CSS lockdown runs.
* add plugin exception list and honest wording
Config page lists installed plugins with a checkbox each, for the ones that
need to answer guests during playback. Default is unticked.
Renames the hidden selectors setting to say it is cosmetic, and stops the
readme implying the web client lockdown confines anything.
* bump to 1.0.4.0
Francois CB