timothy and timothy
0c063c23fb
harden(421,559): percent-encode access_token in IPTV URLs, redact from logs, no-store on tokened manifests ( #574 )
...
Build ErsatzTV Image / API docs in sync (OpenAPI + endpoint index) (push) Has been skipped
Build ErsatzTV Image / Formatting (changed .cs conform to .editorconfig) (push) Has been skipped
Build ErsatzTV Image / Build & test (.NET) (push) Successful in 7m45s
Build ErsatzTV Image / Functional E2E (curl contracts) (push) Successful in 14m19s
Build ErsatzTV Image / EF migration integrity (SQLite + MySql) (push) Successful in 18m27s
Build ErsatzTV Image / Build & push image (amd64) (push) Successful in 4m10s
Co-authored-by: Timothy <timothy.look@gmail.com >
Co-committed-by: Timothy <timothy.look@gmail.com >
2026-07-23 16:30:59 +00:00
timothy and Claude Opus 4.8
cf834d8b60
security( #283 ): sniff artwork content type from bytes, remove serve-side ?contentType= reflection
...
Build ErsatzTV Image / Docs update reminder (pull_request) Successful in 5s
Build ErsatzTV Image / Build & test (.NET) (pull_request) Successful in 8m33s
Build ErsatzTV Image / EF migration integrity (SQLite + MySql) (pull_request) Successful in 10m40s
Build ErsatzTV Image / Build & push image (amd64) (pull_request) Has been skipped
S4 stored-XSS + S9 upload-size DoS from the #197 cold API review.
The artwork path trusted client-supplied content types at both ends: upload
validated only the declared multipart Content-Type (never decoded the bytes),
and serving reflected a client `?contentType=` straight into the response
Content-Type on unauthenticated GET sinks (/iptv/logos, /artwork/watermarks).
Chain: upload <script> bytes as image/png -> GET ...?contentType=text/html
serves them as HTML in-origin. nosniff (#279 ) does not help because the server
explicitly declares text/html.
- Upload: derive the content type from the bytes via SkiaSharp SKCodec
(header-only, no decode -> no decompression-bomb path); reject non-images 422.
New ErsatzTV.Core/Images/ImageContentTypes as the single allow-list source.
Dropped the untrusted declared Content-Type from the UploadArtwork command.
- Serve: removed the ?contentType= reflection structurally -- dropped ContentType
from GetCachedImagePath and the [FromQuery] binding on GetImage/GetWatermark;
the handler always sniffs the file, defaulting application/octet-stream.
ArtworkContentTypeModel.UrlWithContentType is now the bare path; SPA previews
no longer append the query.
- Defense-in-depth: channel-logo / watermark {path, contentType} DTOs run through
ArtworkContentTypeModel.Sanitized(), blanking non-allow-listed types on write.
- S9: Kestrel MaxRequestBodySize from ETV_MAXIMUM_UPLOAD_MB rejects oversized
bodies during read (controller file.Length check kept as friendly-error backstop).
Both serve sinks are IgnoreApi, so no OpenAPI change. Tests: byte-sniff accept/
reject, Sanitized() allow-list, Location no longer carries ?contentType=.
Docs: api-conventions §4a + decisions.md 2026-07-12.
Refs #283 #197 #66
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:07:55 +02:00
timothy
9cd107bc8d
feat(core): track direct stream sessions
...
refs #99
2026-07-04 19:57:50 +02:00
5c42609527
Add base URL to variant playlists ( #2755 )
...
* Add PathBase to variant playlists
* add commented code to help with testing
* update changelog
---------
Co-authored-by: Jason Dove <1695733+jasongdove@users.noreply.github.com >
2026-01-05 09:13:04 -06:00
Jason Dove and GitHub
54606c76f9
framerate improvements ( #2692 )
...
* framerate improvements
* fixes
2025-12-02 12:20:09 -06:00
Jason Dove and GitHub
42b35f7aae
add channel playback troubleshooter ( #2641 )
...
* fix motion graphics loop when seeking
* add channel playback troubleshooter
* fix errors
2025-11-12 13:21:18 -06:00
Jason Dove and GitHub
0dbdcc3674
fix hls direct with jellyfin 10.11 ( #2570 )
2025-10-26 18:09:37 -05:00
Jason Dove and GitHub
a47510fef3
add aac (latm) audio format ( #2561 )
...
* add aac (latm) audio format
* update changelog
2025-10-23 15:56:13 -05:00
Jason Dove and GitHub
2ef2b0299a
switch back from fmp4 to ts segments ( #2554 )
...
* restore pts offset calculation
* use ts segments again
* update changelog
2025-10-21 12:17:05 -05:00
Jason Dove and GitHub
ffe15629cb
consolidate streaming modes ( #2544 )
...
* consolidate segmenters
* let old segmenter mode query params continue to work
2025-10-18 10:54:30 -05:00
Jason Dove and GitHub
c39858b2d8
fix hls direct ( #2487 )
2025-10-04 15:36:36 -05:00
Jason Dove and GitHub
fac0f36d35
add codec info to multivariant playlist ( #2472 )
...
* add codec info to multivariant playlist
* upgrade dependencies
2025-09-30 13:58:24 -05:00
Jason Dove and GitHub
b46de50801
add hls segmenter fmp4 streaming mode ( #2468 )
...
* add streaming mode segmenter fmp4
* allow hevc channel preview
2025-09-30 10:04:02 -05:00
Jason Dove and GitHub
5d081ceeff
fix editorconfig and run code cleanup ( #2324 )
...
* fix formatting rules
* reformat ersatztv
* reformat ersatztv.application
* reformat ersatztv.core
* refactor ersatztv.core.tests
* reformat ersatztv.ffmpeg
* reformat ersatztv.ffmpeg.tests
* reformat ersatztv.infrastructure
* cleanup infra mysql
* cleanup infra sqlite
* cleanup infra tests
* cleanup ersatztv.scanner
* cleanup ersatztv.scanner.tests
* sln cleanup
* update dependencies
2025-08-16 14:44:48 +00:00
Jason Dove and GitHub
b40ac9ef52
replace channel active mode with is enabled and show in epg ( #2256 )
...
* add channel enabled setting
* remove channel active mode
2025-08-04 21:24:26 +00:00
Jason Dove and GitHub
7e30444857
dependencies and code cleanup ( #2117 )
...
* fix validation in new form layout
* pin mediatr to last oss version
* update dependencies
* cleanup code in core
* cleanup code in ffmpeg
* cleanup code in infra
* cleanup code in scanner
* cleanup code in application
* cleanup main code
* cleanup test code
* solution-wide code cleanup
2025-07-06 15:56:17 +00:00
Jason Dove and GitHub
f6249d9fa4
channel logo and watermark fixes ( #2100 )
...
* channel logo and watermark fixes
* update changelog
2025-07-01 13:40:30 +00:00
Jason Dove and GitHub
583cbf7b14
add channel active mode ( #2083 )
2025-06-27 21:19:26 +00:00
Jason Dove and GitHub
6d152e4b4a
use more accurate BANDWIDTH value in multi-variant playlist ( #2023 )
2025-06-07 20:45:07 +00:00
Jason Dove and GitHub
c2b7be66af
restart hls session in some cases ( #1880 )
2024-08-23 12:59:48 -05:00
Sylvain and GitHub
0e3c32bd83
Adding more HEAD handling ( https://github.com/ErsatzTV/ErsatzTV/pull/1786 ) ( #1787 )
2024-07-13 06:28:28 -05:00
Sylvain and GitHub
687a4f4f10
Alow HEAD requests on /iptv/channels.m3u ( #1779 )
2024-07-08 13:10:36 -05:00
Jason Dove and GitHub
a87ec2d75d
cleanup ( #1708 )
...
* fix blazor naming
* code cleanup
* update dependencies
2024-05-06 17:00:52 -05:00
Jason Dove and GitHub
35eb200aee
more segmenter v2 improvements ( #1685 )
...
* more segmenter v2 improvements
* changelog updates
2024-04-21 19:17:06 -05:00
Jason Dove and GitHub
da20393a39
allow m3u8 playlist head requests ( #1683 )
2024-04-21 08:18:05 -05:00
Jason Dove and GitHub
4e56117e0e
use jwt for mpeg-ts streaming mode ( #1661 )
2024-03-29 21:36:49 -05:00
Jason Dove and GitHub
087901d177
adjust block unique constraint ( #1634 )
...
* upgrade dependencies
* allow blocks with same name in different groups
* code cleanup
2024-03-05 10:39:06 -06:00
Jason Dove and GitHub
35817f09ac
add hls segmenter v2 streaming mode ( #1620 )
...
* concat segmenter process kind of works
* segmenter v2 improvements
* rework to allow hw accel in concat segmenter
* remove shortest; use different audio alignment filter
* hls v2 improvements
* fix tests
* update changelog
2024-02-19 13:59:33 -06:00
Jason Dove and GitHub
356e0f101a
fix edge case where channel would fail to start ( #1611 )
2024-02-13 10:01:02 -06:00
Jason Dove and GitHub
1f6e843a26
fix segmenter timestamp continuity ( #1610 )
2024-02-12 08:50:18 -06:00
Jason Dove and GitHub
6923b25177
add more log level switches ( #1582 )
...
* label block and json playouts as experimental
* add more log level switches
2024-01-30 13:10:19 -06:00
Jason Dove and GitHub
7fffc8cf63
channel preview player ( #1579 )
...
* add channel preview
* add button to stop transcoding session
2024-01-29 20:52:52 -06:00
Jason Dove and GitHub
547db5fb51
add kodiprop to channels.m3u ( #1448 )
2023-09-26 15:47:55 -05:00
Jason Dove and GitHub
694b6bbd91
scaling behavior and normalize loudness ( #1439 )
...
* update changelog [no ci]
* add ffmpeg profile scaling behavior
* update dependencies
* add normalize loudness mode
* update changelog
2023-09-21 02:46:43 -05:00
Jason Dove and GitHub
9f42333465
cache data for xmltv ( #1228 )
...
* cache channel list for xmltv
* used cached channel data for xmltv
* fixes
* update changelog
2023-04-03 23:09:54 -05:00
9ba0b844a1
JWT Query Parameter Auth for IPTV Links ( #1215 )
...
* JWT Auth
* Standardized url variable additions
* formatting and minor refactoring
* this isn't needed
* allow channel logos without auth
* update changelog
---------
Co-authored-by: Ministorm3 <4474921+Ministorm3@users.noreply.github.com >
2023-03-17 09:33:15 -05:00
Jason Dove and GitHub
ab1c67e60e
memory improvements ( #1127 )
...
* regularly release memory
* don't aggressively GC while legacy streaming
* update changelog
2023-01-22 09:16:24 -06:00
Jason Dove and GitHub
776bce9087
use base path in channel playlist and channel guide ( #1028 )
2022-11-20 08:28:14 -06:00
Jason Dove and GitHub
2ce0fcb264
proxy server improvements ( #996 )
2022-10-13 12:17:13 -05:00
Jason Dove and GitHub
5546ad204c
upgrade to ffmpeg 5.1 ( #931 )
...
* use ffmpeg 5.1 on windows
* remove some debug logs
* use latest ffmpeg on arm
* use ffmpeg 5.1 base images
* update ffmpeg health check for 5.1
* update changelog
2022-08-17 14:57:23 -05:00
Jason Dove and GitHub
8e79141860
use multi-variant playlists for hls segmenter ( #926 )
...
* use multi-variant playlists for hls segmenter
* use lowercase mime type
2022-08-13 19:58:08 -05:00
Jason Dove and GitHub
9b3545f7ca
add some temporary debug logging ( #925 )
2022-08-13 19:19:47 -05:00
Jason Dove and GitHub
c02b83d0d6
code cleanup ( #743 )
...
* update tools
* run code cleanup
* update dependencies
2022-04-19 17:47:18 -05:00
Jason Dove and GitHub
7e55681916
fix cliwrap usage ( #737 )
2022-04-16 20:12:18 -05:00
Jason Dove and GitHub
25bc500a2b
ensure HDHR clients always get an MPEG-TS stream ( #721 )
2022-04-03 18:03:34 -05:00
Jason Dove and GitHub
df45b93819
burn in picture-based subtitles ( #718 )
...
* add subtitle mode setting
* start to add subtitle support
* cuda test
* move subtitle settings from ffmpeg profile to channel
* fix image-based subtitles
* experimental wip
* subtitle fixes
2022-03-31 18:15:57 -05:00
Jason Dove and GitHub
7de1a87bbf
bug fixes ( #703 )
...
* catch expected shutdown error in scheduler service
* fix streaming mode inconsistencies
2022-03-13 18:45:21 -05:00
Jason Dove and GitHub
a2e7e6df1e
fix thread sync bug in hls segmenter ( #676 )
2022-03-05 11:26:29 -06:00
Jason Dove and GitHub
1ab98578ab
refactor namespaces and imports ( #670 )
...
* re-namespace
* optimize usings
* more usings
* more of the same
* more implicit/global usings
* cleanup all usings
* minor fixes
2022-03-03 15:36:07 -06:00
Jason Dove and GitHub
1d6279cee8
log problematic playlists ( #640 )
2022-02-16 08:18:22 -06:00
