Set version to 5.1.2

Merge branch '5.1.x'
Update text files for 5.1.2
2026-09-08 19:50:15 -04:00 · 2026-08-25 16:23:34 +02:00 · 2026-08-25 16:23:17 +02:00 · 2026-08-25 16:21:59 +02:00 · 2026-08-25 13:24:45 +02:00 · 2026-08-25 13:24:37 +02:00
18 changed files with 875 additions and 309 deletions
@@ -1,7 +1,80 @@
-Release Notes - SABnzbd 5.1.0 Release Candidate 2
+Release Notes - SABnzbd 5.1.2
 =========================================================

-This is the second release candidate of version 5.1.
+SABnzbd 5.1.1 and 5.1.2 resolved 3 serious vulnerabilities.
+
+## Critical remote code execution vulnerability resolved in 5.1.2 (GHSA-rgqj-28c2-gxwp)
+
+You are only affected if an untrusted party can reach the web interface.
+By default, SABnzbd is only accessible from your own device and `External internet access`
+is set to `No access`. If either of those is still at its default, or if you use a proxy
+service for authentication, you are not affected.
+
+In version 5.1.1 and earlier, an attacker who can reach the web interface could bypass
+authentication on configuration endpoints, even when SABnzbd is protected with a username
+and password. By changing SABnzbd's settings this way, an attacker could ultimately execute
+arbitrary commands on the system running SABnzbd, with the same permissions as SABnzbd itself.
+This also means that all information in SABnzbd would be exposed.
+
+See GHSA-xrfq-jhgh-wqch below for actions and mitigations.
+More information: https://sabnzbd.org/5-1-vulnerabilities
+
+## High-severity path traversal vulnerability resolved in 5.1.2 (GHSA-75g3-96fr-7p2r)
+
+You are affected if SABnzbd processes NZBs or downloads from a source you do not fully
+trust, such as a public indexer.
+
+In version 5.1.1 and earlier, a maliciously crafted PAR2 or SFV file inside a download
+could cause SABnzbd to move downloaded content outside of the job's own folder during
+post-processing. By using this to plant a file in another job's internal administration,
+an attacker could ultimately execute arbitrary commands on the system running SABnzbd,
+with the same permissions as SABnzbd itself.
+
+The only mitigation is to update, there is no configuration change that prevents this.
+More information: https://sabnzbd.org/5-1-vulnerabilities
+
+## Critical authentication vulnerability resolved in 5.1.1 (GHSA-xrfq-jhgh-wqch)
+
+You are only affected if an untrusted party can reach the web interface.
+By default, SABnzbd is only accessible from your own device and `External internet access`
+is set to `No access`. If either of those is still at its default, or if you use a proxy
+service for authentication, you are not affected.
+
+If the SABnzbd login page is reachable from outside your network, an attacker could
+obtain a valid session in version 5.1.0 and earlier, even when SABnzbd is protected with
+a username and password. This means that all information in SABnzbd would be exposed.
+
+If you rely on the SABnzbd username and password to keep out other users on your
+network or the internet, it is recommended that you change the following
+sensitive information after applying the update:
+
+* SABnzbd username and password.
+* SABnzbd API-key.
+* Usenet server passwords.
+* API-keys from indexers used within RSS-feeds.
+* Authentication information for notification services.
+
+If you cannot update right away, the only mitigations are to ensure the web interface is not
+reachable by untrusted parties, or to lower `External internet access` to `Full API` or below.
+
+More information: https://sabnzbd.org/5-1-vulnerabilities
+
+## Other bug fixes in 5.1.2
+
+* RSS filters were not applied directly.
+
+## Other bug fixes in 5.1.1
+
+* Styling cache issues could occur after updating.
+* RSS items were removed too eagerly from RSS-history after download.
+* The RSS-feed `Clear Downloaded` button did not do anything.
+
+## Changelog 5.1.0
+
+This release brings a fundamental improvement to "Retry": instead of
+re-downloading any files with missing data, only the articles that were actually
+missing are fetched again. RSS got an overhaul under the hood, the interface is
+refreshed, and we added quite a long list of long-requested features and bugfixes.

 ## New features in 5.1.0

@@ -39,10 +112,12 @@ This is the second release candidate of version 5.1.
 * Diskspace checks would be too strict when unpacking to different disk.
 * Prevent deadlock when a second signal arrives during shutdown procedure.
 * Verification using SFV-checks could fail, even though files were correct.
+* Don't log Warning during clean shutdowns.
 * Windows: Uninstall would not remove Settings or Windows Service.
 * Windows: Warn for OS-limit if more than 1024 connections are configured.
 * macOS: AppleDouble files could result in failures in `Moving` stage.
 * macOS: Restarting the application resulted in Terminal window.
+* macOS: Included par2cmdline-turbo will now use all available CPU-features.

 ## Upgrade notices

@@ -1 +1 @@
-@import url('Night.css') screen and (prefers-color-scheme: dark);
+@import url('Night.css?lastmajorupdate=510') screen and (prefers-color-scheme: dark);
@@ -1 +1 @@
-@import url('Night.css') screen and (prefers-color-scheme: dark);
+@import url('Night.css?lastmajorupdate=510') screen and (prefers-color-scheme: dark);
@@ -1,237 +1,243 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!-- Copyright 2022-2026 by The SABnzbd-Team (sabnzbd.org) -->
 <component type="desktop-application">
-  <id>org.sabnzbd.sabnzbd</id>
-  <metadata_license>MIT</metadata_license>
-  <name>SABnzbd</name>
-  <summary>Free and easy binary newsreader</summary>
-  <summary xml:lang="fr">Lecteur de news binaire libre et facile à utiliser</summary>
-  <summary xml:lang="tr">Özgür ve kullanımı kolay Usenet ikili okuyucu</summary>
-  <branding>
-    <color type="primary" scheme_preference="light">#e7e7e7</color>
-    <color type="primary" scheme_preference="dark">#444444</color>
-  </branding>
-  <description>
-    <p>
-      SABnzbd is a free and Open Source web-based binary newsreader,
-      with support for the popular nzb file format. It greatly simplifies
-      the process of downloading from Usenet, thanks to a friendly
-      web-based user interface and advanced built-in post-processing
-      options including the ability to automatically verify, repair,
-      extract and clean up downloaded posts. It runs anywhere, comes in
-      over a dozen languages, and integrates with a host of tools, apps
-      and services that help automate the download process.
-    </p>
-    <p xml:lang="fr">
-      SABnzbd est un lecteur binaire de newsgroups libre et gratuit prenant
-      en charge le format nzb très répandu. Il simplifie grandement le processus
-      de téléchargement depuis Usenet grâce à une interface web conviviale
-      et à des options avancées de post-traitement intégrées qui comprennent
-      la capacité à vérifier, réparer, extraire et nettoyer automatiquement
-      les messages téléchargés. Il fonctionne partout, est fourni avec une
-      douzaine de traductions et s'intègre avec de nombreux outils, applications
-      et services qui aident à automatiser le processus de téléchargement.
-    </p>
-    <p xml:lang="tr">
-      SABnzbd, popüler nzb biçimini destekleyen özgür ve ücretsiz bir ikili
-      haber grupları okuyucusudur. Kullanıcı dostu Web tabanlı arayüzü ve
-      indirilen mesajları otomatik olarak doğrulama, tamir etme, çıkarma ve
-      temizleme kabiliyetine sahip gelişmiş yerleşik son işlem seçenekleri
-      sayesinde Usenet ağından indirmeyi büyük ölçüde kolaylaştırır. Her yerde
-      çalışabilir, bir düzineden fazla dil desteği sunar ve indirme sürecini
-      otomatik hâle getirmeye yardımcı olan birçok araç, uygulama ve hizmet ile
-      birlikte çalışabilir.
-    </p>
-  </description>
-  <keywords>
-    <keyword>usenet</keyword>
-    <keyword>nzb</keyword>
-    <keyword>download</keyword>
-    <keyword>newsreader</keyword>
-    <keyword>binary</keyword>
-    <keyword xml:lang="fr">usenet</keyword>
-    <keyword xml:lang="fr">nzb</keyword>
-    <keyword xml:lang="fr">téléchargement</keyword>
-    <keyword xml:lang="fr">binaires</keyword>
-    <keyword xml:lang="tr">usenet</keyword>
-    <keyword xml:lang="tr">nzb</keyword>
-    <keyword xml:lang="tr">indirme</keyword>
-  </keywords>
-  <categories>
-    <category>Network</category>
-    <category>FileTransfer</category>
-  </categories>
-  <url type="homepage">https://sabnzbd.org</url>
-  <url type="bugtracker">https://github.com/sabnzbd/sabnzbd/issues</url>
-  <url type="vcs-browser">https://github.com/sabnzbd/sabnzbd</url>
-  <url type="contribute">https://github.com/sabnzbd/sabnzbd</url>
-  <url type="translate">https://sabnzbd.org/wiki/translate</url>
-  <url type="donation">https://sabnzbd.org/donate</url>
-  <url type="help">https://sabnzbd.org/wiki/</url>
-  <url type="faq">https://sabnzbd.org/wiki/faq</url>
-  <url type="contact">https://sabnzbd.org/live-chat.html</url>
-  <releases>
-    <release version="5.1.0" date="2026-08-01" type="stable">
-      <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/5.1.0</url>
-    </release>
-    <release version="5.0.4" date="2026-06-11" type="stable">
-      <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/5.0.4</url>
-    </release>
-    <release version="5.0.3" date="2026-05-15" type="stable">
-      <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/5.0.3</url>
-    </release>
-    <release version="5.0.2" date="2026-05-14" type="stable">
-      <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/5.0.2</url>
-    </release>
-    <release version="5.0.1" date="2026-05-01" type="stable">
-      <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/5.0.1</url>
-    </release>
-    <release version="5.0.0" date="2026-05-01" type="stable">
-      <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/5.0.0</url>
-    </release>
-    <release version="4.5.5" date="2025-10-24" type="stable">
-      <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/4.5.5</url>
-    </release>
-    <release version="4.5.4" date="2025-10-22" type="stable">
-      <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/4.5.4</url>
-    </release>
-    <release version="4.5.3" date="2025-08-25" type="stable">
-      <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/4.5.3</url>
-    </release>
-    <release version="4.5.2" date="2025-07-09" type="stable">
-      <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/4.5.2</url>
-    </release>
-    <release version="4.5.1" date="2025-04-11" type="stable">
-      <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/4.5.1</url>
-    </release>
-    <release version="4.5.0" date="2025-04-01" type="stable">
-      <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/4.5.0</url>
-    </release>
-    <release version="4.4.1" date="2024-12-23" type="stable">
-      <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/4.4.1</url>
-    </release>
-    <release version="4.4.0" date="2024-12-09" type="stable">
-      <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/4.4.0</url>
-    </release>
-    <release version="4.3.3" date="2024-08-01" type="stable">
-      <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/4.3.3</url>
-    </release>
-    <release version="4.3.2" date="2024-05-30" type="stable">
-      <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/4.3.2</url>
-    </release>
-    <release version="4.3.1" date="2024-05-03" type="stable">
-      <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/4.3.1</url>
-    </release>
-  </releases>
-  <launchable type="desktop-id">sabnzbd.desktop</launchable>
-  <provides>
-    <mediatype>application/x-nzb</mediatype>
-    <mediatype>application/x-compressed-nzb</mediatype>
-  </provides>
-  <supports>
-    <control>pointing</control>
-    <control>keyboard</control>
-    <control>touch</control>
-  </supports>
-  <recommends>
-    <display_length compare="ge">640</display_length>
-    <internet>always</internet>
-  </recommends>
-  <project_license>GPL-2.0-or-later</project_license>
-  <developer id="org.sabnzbd">
-    <name>The SABnzbd-Team</name>
-  </developer>
-  <screenshots>
-    <screenshot type="default">
-      <image>https://sabnzbd.org/images/landing/screenshots/interface.png</image>
-      <caption>Intuitive interface</caption>
-      <caption xml:lang="fr">Interface intuitive</caption>
-      <caption xml:lang="tr">Sezgisel arayüz</caption>
-    </screenshot>
-    <screenshot>
-      <image>https://sabnzbd.org/images/landing/screenshots/night-mode.png</image>
-      <caption>Also comes in Night-mode</caption>
-      <caption xml:lang="fr">Fourni également avec le mode nuit</caption>
-      <caption xml:lang="tr">Gece kipi ile de sunulur</caption>
-    </screenshot>
-    <screenshot>
-      <image>https://sabnzbd.org/images/landing/screenshots/add-nzb.png</image>
-      <caption>Add NZB's or use drag-and-drop!</caption>
-      <caption xml:lang="fr">Ajoutez des fichiers NZB ou utilisez le glisser - déposer !</caption>
-      <caption xml:lang="tr">NZB dosyaları ekleyin veya kaydır - bırak kullanın!</caption>
-    </screenshot>
-    <screenshot>
-      <image>https://sabnzbd.org/images/landing/screenshots/phone-interface.png</image>
-      <caption>Scales to any screen size</caption>
-      <caption xml:lang="fr">S'adapte à toutes les tailles d'écran</caption>
-      <caption xml:lang="tr">Her ekran boyutuna uyum sağlar</caption>
-    </screenshot>
-    <screenshot>
-      <image>https://sabnzbd.org/images/landing/screenshots/history-details.png</image>
-      <caption>Easy overview of all history details</caption>
-      <caption xml:lang="fr">Vue d'ensemble aisée de tous les détails de l'historique</caption>
-      <caption xml:lang="tr">Tarihçenin tüm ayrıntıları için kolay genel bakış</caption>
-    </screenshot>
-    <screenshot>
-      <image>https://sabnzbd.org/images/landing/screenshots/phone-extra.png</image>
-      <caption>Every option, on every screen size</caption>
-      <caption xml:lang="fr">Toutes les options, quelle que soit la taille d'écran</caption>
-      <caption xml:lang="tr">Ekran boyutu ne olursa olsun, tüm seçenekler elinizin altında</caption>
-    </screenshot>
-    <screenshot>
-      <image>https://sabnzbd.org/images/landing/screenshots/file-lists.png</image>
-      <caption>Manage a job's individual files</caption>
-      <caption xml:lang="fr">Gérez les fichiers individuels d'une tâche</caption>
-      <caption xml:lang="tr">Herhangi bir görevin dosyalarını tek tek yönetin</caption>
-    </screenshot>
-    <screenshot>
-      <image>https://sabnzbd.org/images/landing/screenshots/set-speedlimit.png</image>
-      <caption>Easy speed limiting</caption>
-      <caption xml:lang="fr">Limitation facile du débit</caption>
-      <caption xml:lang="tr">Kolay hız sınırlaması</caption>
-    </screenshot>
-    <screenshot>
-      <image>https://sabnzbd.org/images/landing/screenshots/set-options.png</image>
-      <caption>Quickly change settings</caption>
-      <caption xml:lang="fr">Changement rapide des réglages</caption>
-      <caption xml:lang="tr">Ayarları hızlıca değiştirin</caption>
-    </screenshot>
-    <screenshot>
-      <image>https://sabnzbd.org/images/landing/screenshots/dashboard.png</image>
-      <caption>Easy system check</caption>
-      <caption xml:lang="fr">Vérification facile du système</caption>
-      <caption xml:lang="tr">Sistemi kolayca kontrol edin</caption>
-    </screenshot>
-    <screenshot>
-      <image>https://sabnzbd.org/images/landing/screenshots/connections-overview.png</image>
-      <caption>See active connections</caption>
-      <caption xml:lang="fr">Voyez les connexions actives</caption>
-      <caption xml:lang="tr">Etkin bağlantıları görüntüleyin</caption>
-    </screenshot>
-    <screenshot>
-      <image>https://sabnzbd.org/images/landing/screenshots/skin-settings.png</image>
-      <caption>Customize the interface</caption>
-      <caption xml:lang="fr">Personnalisez l'interface</caption>
-      <caption xml:lang="tr">Arayüzü kişiselleştirin</caption>
-    </screenshot>
-    <screenshot>
-      <image>https://sabnzbd.org/images/landing/screenshots/tabbed.png</image>
-      <caption>Tabbed-mode</caption>
-      <caption xml:lang="fr">Mode avec onglets</caption>
-      <caption xml:lang="tr">Sekmeli kip</caption>
-    </screenshot>
-    <screenshot>
-      <image>https://sabnzbd.org/images/landing/screenshots/set-custom-pause.png</image>
-      <caption>Specify any pause duration</caption>
-      <caption xml:lang="fr">Spécifiez une durée de pause quelconque</caption>
-      <caption xml:lang="tr">Herhangi bir duraklama süresi belirtin</caption>
-    </screenshot>
-    <screenshot>
-      <image>https://sabnzbd.org/images/landing/screenshots/config.png</image>
-      <caption>Easy configuration</caption>
-      <caption xml:lang="fr">Configuration facile</caption>
-      <caption xml:lang="tr">Kolay yapılandırma</caption>
-    </screenshot>
-  </screenshots>
-  <content_rating type="oars-1.1"/>
+    <id>org.sabnzbd.sabnzbd</id>
+    <metadata_license>MIT</metadata_license>
+    <name>SABnzbd</name>
+    <summary>Free and easy binary newsreader</summary>
+    <summary xml:lang="fr">Lecteur de news binaire libre et facile à utiliser</summary>
+    <summary xml:lang="tr">Özgür ve kullanımı kolay Usenet ikili okuyucu</summary>
+    <branding>
+        <color type="primary" scheme_preference="light">#e7e7e7</color>
+        <color type="primary" scheme_preference="dark">#444444</color>
+    </branding>
+    <description>
+        <p>
+            SABnzbd is a free and Open Source web-based binary newsreader,
+            with support for the popular nzb file format. It greatly simplifies
+            the process of downloading from Usenet, thanks to a friendly
+            web-based user interface and advanced built-in post-processing
+            options including the ability to automatically verify, repair,
+            extract and clean up downloaded posts. It runs anywhere, comes in
+            over a dozen languages, and integrates with a host of tools, apps
+            and services that help automate the download process.
+        </p>
+        <p xml:lang="fr">
+            SABnzbd est un lecteur binaire de newsgroups libre et gratuit prenant
+            en charge le format nzb très répandu. Il simplifie grandement le processus
+            de téléchargement depuis Usenet grâce à une interface web conviviale
+            et à des options avancées de post-traitement intégrées qui comprennent
+            la capacité à vérifier, réparer, extraire et nettoyer automatiquement
+            les messages téléchargés. Il fonctionne partout, est fourni avec une
+            douzaine de traductions et s'intègre avec de nombreux outils, applications
+            et services qui aident à automatiser le processus de téléchargement.
+        </p>
+        <p xml:lang="tr">
+            SABnzbd, popüler nzb biçimini destekleyen özgür ve ücretsiz bir ikili
+            haber grupları okuyucusudur. Kullanıcı dostu Web tabanlı arayüzü ve
+            indirilen mesajları otomatik olarak doğrulama, tamir etme, çıkarma ve
+            temizleme kabiliyetine sahip gelişmiş yerleşik son işlem seçenekleri
+            sayesinde Usenet ağından indirmeyi büyük ölçüde kolaylaştırır. Her yerde
+            çalışabilir, bir düzineden fazla dil desteği sunar ve indirme sürecini
+            otomatik hâle getirmeye yardımcı olan birçok araç, uygulama ve hizmet ile
+            birlikte çalışabilir.
+        </p>
+    </description>
+    <keywords>
+        <keyword>usenet</keyword>
+        <keyword>nzb</keyword>
+        <keyword>download</keyword>
+        <keyword>newsreader</keyword>
+        <keyword>binary</keyword>
+        <keyword xml:lang="fr">usenet</keyword>
+        <keyword xml:lang="fr">nzb</keyword>
+        <keyword xml:lang="fr">téléchargement</keyword>
+        <keyword xml:lang="fr">binaires</keyword>
+        <keyword xml:lang="tr">usenet</keyword>
+        <keyword xml:lang="tr">nzb</keyword>
+        <keyword xml:lang="tr">indirme</keyword>
+    </keywords>
+    <categories>
+        <category>Network</category>
+        <category>FileTransfer</category>
+    </categories>
+    <url type="homepage">https://sabnzbd.org</url>
+    <url type="bugtracker">https://github.com/sabnzbd/sabnzbd/issues</url>
+    <url type="vcs-browser">https://github.com/sabnzbd/sabnzbd</url>
+    <url type="contribute">https://github.com/sabnzbd/sabnzbd</url>
+    <url type="translate">https://sabnzbd.org/wiki/translate</url>
+    <url type="donation">https://sabnzbd.org/donate</url>
+    <url type="help">https://sabnzbd.org/wiki/</url>
+    <url type="faq">https://sabnzbd.org/wiki/faq</url>
+    <url type="contact">https://sabnzbd.org/live-chat.html</url>
+    <releases>
+        <release version="5.1.2" date="2026-08-25" type="stable">
+            <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/5.1.2</url>
+        </release>
+        <release version="5.1.1" date="2026-08-18" type="stable">
+            <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/5.1.1</url>
+        </release>
+        <release version="5.1.0" date="2026-08-10" type="stable">
+            <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/5.1.0</url>
+        </release>
+        <release version="5.0.4" date="2026-06-11" type="stable">
+            <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/5.0.4</url>
+        </release>
+        <release version="5.0.3" date="2026-05-15" type="stable">
+            <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/5.0.3</url>
+        </release>
+        <release version="5.0.2" date="2026-05-14" type="stable">
+            <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/5.0.2</url>
+        </release>
+        <release version="5.0.1" date="2026-05-01" type="stable">
+            <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/5.0.1</url>
+        </release>
+        <release version="5.0.0" date="2026-05-01" type="stable">
+            <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/5.0.0</url>
+        </release>
+        <release version="4.5.5" date="2025-10-24" type="stable">
+            <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/4.5.5</url>
+        </release>
+        <release version="4.5.4" date="2025-10-22" type="stable">
+            <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/4.5.4</url>
+        </release>
+        <release version="4.5.3" date="2025-08-25" type="stable">
+            <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/4.5.3</url>
+        </release>
+        <release version="4.5.2" date="2025-07-09" type="stable">
+            <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/4.5.2</url>
+        </release>
+        <release version="4.5.1" date="2025-04-11" type="stable">
+            <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/4.5.1</url>
+        </release>
+        <release version="4.5.0" date="2025-04-01" type="stable">
+            <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/4.5.0</url>
+        </release>
+        <release version="4.4.1" date="2024-12-23" type="stable">
+            <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/4.4.1</url>
+        </release>
+        <release version="4.4.0" date="2024-12-09" type="stable">
+            <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/4.4.0</url>
+        </release>
+        <release version="4.3.3" date="2024-08-01" type="stable">
+            <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/4.3.3</url>
+        </release>
+        <release version="4.3.2" date="2024-05-30" type="stable">
+            <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/4.3.2</url>
+        </release>
+        <release version="4.3.1" date="2024-05-03" type="stable">
+            <url type="details">https://github.com/sabnzbd/sabnzbd/releases/tag/4.3.1</url>
+        </release>
+    </releases>
+    <launchable type="desktop-id">sabnzbd.desktop</launchable>
+    <provides>
+        <mediatype>application/x-nzb</mediatype>
+        <mediatype>application/x-compressed-nzb</mediatype>
+    </provides>
+    <supports>
+        <control>pointing</control>
+        <control>keyboard</control>
+        <control>touch</control>
+    </supports>
+    <recommends>
+        <display_length compare="ge">640</display_length>
+        <internet>always</internet>
+    </recommends>
+    <project_license>GPL-2.0-or-later</project_license>
+    <developer id="org.sabnzbd">
+        <name>The SABnzbd-Team</name>
+    </developer>
+    <screenshots>
+        <screenshot type="default">
+            <image>https://sabnzbd.org/images/landing/screenshots/interface.png</image>
+            <caption>Intuitive interface</caption>
+            <caption xml:lang="fr">Interface intuitive</caption>
+            <caption xml:lang="tr">Sezgisel arayüz</caption>
+        </screenshot>
+        <screenshot>
+            <image>https://sabnzbd.org/images/landing/screenshots/night-mode.png</image>
+            <caption>Also comes in Night-mode</caption>
+            <caption xml:lang="fr">Fourni également avec le mode nuit</caption>
+            <caption xml:lang="tr">Gece kipi ile de sunulur</caption>
+        </screenshot>
+        <screenshot>
+            <image>https://sabnzbd.org/images/landing/screenshots/add-nzb.png</image>
+            <caption>Add NZB's or use drag-and-drop!</caption>
+            <caption xml:lang="fr">Ajoutez des fichiers NZB ou utilisez le glisser - déposer !</caption>
+            <caption xml:lang="tr">NZB dosyaları ekleyin veya kaydır - bırak kullanın!</caption>
+        </screenshot>
+        <screenshot>
+            <image>https://sabnzbd.org/images/landing/screenshots/phone-interface.png</image>
+            <caption>Scales to any screen size</caption>
+            <caption xml:lang="fr">S'adapte à toutes les tailles d'écran</caption>
+            <caption xml:lang="tr">Her ekran boyutuna uyum sağlar</caption>
+        </screenshot>
+        <screenshot>
+            <image>https://sabnzbd.org/images/landing/screenshots/history-details.png</image>
+            <caption>Easy overview of all history details</caption>
+            <caption xml:lang="fr">Vue d'ensemble aisée de tous les détails de l'historique</caption>
+            <caption xml:lang="tr">Tarihçenin tüm ayrıntıları için kolay genel bakış</caption>
+        </screenshot>
+        <screenshot>
+            <image>https://sabnzbd.org/images/landing/screenshots/phone-extra.png</image>
+            <caption>Every option, on every screen size</caption>
+            <caption xml:lang="fr">Toutes les options, quelle que soit la taille d'écran</caption>
+            <caption xml:lang="tr">Ekran boyutu ne olursa olsun, tüm seçenekler elinizin altında</caption>
+        </screenshot>
+        <screenshot>
+            <image>https://sabnzbd.org/images/landing/screenshots/file-lists.png</image>
+            <caption>Manage a job's individual files</caption>
+            <caption xml:lang="fr">Gérez les fichiers individuels d'une tâche</caption>
+            <caption xml:lang="tr">Herhangi bir görevin dosyalarını tek tek yönetin</caption>
+        </screenshot>
+        <screenshot>
+            <image>https://sabnzbd.org/images/landing/screenshots/set-speedlimit.png</image>
+            <caption>Easy speed limiting</caption>
+            <caption xml:lang="fr">Limitation facile du débit</caption>
+            <caption xml:lang="tr">Kolay hız sınırlaması</caption>
+        </screenshot>
+        <screenshot>
+            <image>https://sabnzbd.org/images/landing/screenshots/set-options.png</image>
+            <caption>Quickly change settings</caption>
+            <caption xml:lang="fr">Changement rapide des réglages</caption>
+            <caption xml:lang="tr">Ayarları hızlıca değiştirin</caption>
+        </screenshot>
+        <screenshot>
+            <image>https://sabnzbd.org/images/landing/screenshots/dashboard.png</image>
+            <caption>Easy system check</caption>
+            <caption xml:lang="fr">Vérification facile du système</caption>
+            <caption xml:lang="tr">Sistemi kolayca kontrol edin</caption>
+        </screenshot>
+        <screenshot>
+            <image>https://sabnzbd.org/images/landing/screenshots/connections-overview.png</image>
+            <caption>See active connections</caption>
+            <caption xml:lang="fr">Voyez les connexions actives</caption>
+            <caption xml:lang="tr">Etkin bağlantıları görüntüleyin</caption>
+        </screenshot>
+        <screenshot>
+            <image>https://sabnzbd.org/images/landing/screenshots/skin-settings.png</image>
+            <caption>Customize the interface</caption>
+            <caption xml:lang="fr">Personnalisez l'interface</caption>
+            <caption xml:lang="tr">Arayüzü kişiselleştirin</caption>
+        </screenshot>
+        <screenshot>
+            <image>https://sabnzbd.org/images/landing/screenshots/tabbed.png</image>
+            <caption>Tabbed-mode</caption>
+            <caption xml:lang="fr">Mode avec onglets</caption>
+            <caption xml:lang="tr">Sekmeli kip</caption>
+        </screenshot>
+        <screenshot>
+            <image>https://sabnzbd.org/images/landing/screenshots/set-custom-pause.png</image>
+            <caption>Specify any pause duration</caption>
+            <caption xml:lang="fr">Spécifiez une durée de pause quelconque</caption>
+            <caption xml:lang="tr">Herhangi bir duraklama süresi belirtin</caption>
+        </screenshot>
+        <screenshot>
+            <image>https://sabnzbd.org/images/landing/screenshots/config.png</image>
+            <caption>Easy configuration</caption>
+            <caption xml:lang="fr">Configuration facile</caption>
+            <caption xml:lang="tr">Kolay yapılandırma</caption>
+        </screenshot>
+    </screenshots>
+    <content_rating type="oars-1.1"/>
 </component>
@@ -533,8 +533,8 @@ def delayed_startup_actions():
    # aren't on 24/7 and typically don't benefit from the daily scheduled call at midnight
    sabnzbd.database.scheduled_history_purge()

-    # Purge links older than 3 days
-    sabnzbd.rss.expired_purge()
+    # Drop leftover records of feeds that are no longer configured
+    sabnzbd.rss.purge_removed_feeds()

    # Start SSDP and Bonjour if SABnzbd isn't listening on localhost only
    if sabnzbd.cfg.enable_broadcast() and not misc.is_localhost(cfg.web_host()):
@@ -72,7 +72,12 @@ def decode_par2(parfile: str) -> list[str]:
                new_path = os.path.join(dirname, md5of16k[file_md5of16k])
                # Make sure it's a unique name
                unique_filename = get_unique_filename(new_path)
-                renamer(filepath, unique_filename)
+                # Untrusted par2 name: contain it, skip on traversal
+                try:
+                    renamer(filepath, unique_filename, create_local_directories=True)
+                except OSError:
+                    logging.info("Skipping par2 rename of %s to %s", filepath, unique_filename)
+                    continue
                new_files.append(unique_filename)
    return new_files

@@ -210,13 +210,37 @@ for i in range(1, 32):
    CH_ILLEGAL_WIN += chr(i)


-def sanitize_filename(filename: str) -> str:
+def sanitize_filename(filename: str, allow_subdirs: bool = False) -> str:
    """Return filename with illegal chars converted to legal ones
-    and with the par2 extension always in lowercase
+    and with the par2 extension always in lowercase.
+    With allow_subdirs the forward slashes that par2 uses to separate sub-directories are kept
+    and every part is sanitized on its own. The result is always local to the current folder:
+    empty parts, "." and ".." are dropped, so a leading slash or any amount of traversal can
+    never produce a name that points outside of it. The admin folder is dropped as well, so
+    it can never point into it either.
    """
    if not filename:
        return filename

+    if allow_subdirs:
+        # Par2 always uses a forward slash, no matter which platform created the set
+        parts = []
+        for part in filename.split("/"):
+            if part in ("", os.curdir):
+                continue
+            if part == os.pardir:
+                logging.info("Dropping directory traversal from name %s", filename)
+                continue
+            if part.lower() == JOB_ADMIN.lower():
+                # Never let a name point into the admin folder, its files are pickle-loaded
+                logging.info("Dropping admin folder from name %s", filename)
+                continue
+            parts.append(sanitize_filename(part))
+        # Nothing usable left, or no sub-directories after all
+        if not parts:
+            return "unknown"
+        return os.path.join(*parts)
+
    filename = unicode_nfc_normalize(filename)

    illegal = CH_ILLEGAL
@@ -455,6 +479,23 @@ def same_directory(a: str, b: str) -> int:
            return is_subfolder


+def points_into_admin_dir(path: str, base: str) -> bool:
+    """Return True if path is, or is inside, an admin folder somewhere below base.
+    Both sides are resolved first, because the name alone cannot be trusted: on Windows
+    an NTFS 8.3 alias ("__ADMI~1") and on any platform a link point at a directory that
+    is named differently than the path says. Resolving also settles any case difference.
+    """
+    # realpath() only keeps the \\?\ prefix if it was there to begin with, so clip both
+    # sides: comparing a prefixed path to a plain one would put the admin folder out of
+    # sight and let it pass
+    try:
+        relative = os.path.relpath(clip_path(os.path.realpath(path)), clip_path(os.path.realpath(base)))
+    except ValueError:
+        # Windows only: resolving ended up on another drive, so it left base altogether
+        return True
+    return JOB_ADMIN.lower() in relative.lower().split(os.sep)
+
+
 def is_network_path(path: str) -> bool:
    """Check weither a path is a network path.
    On Windows, use win32 functions to detect users that try to avoid this detection by using a mapped drive letter.
@@ -923,12 +964,21 @@ def renamer(old: str, new: str, create_local_directories: bool = False) -> str:
        oldpath, _ = os.path.split(old)
        # Check not outside directory
        # In case of "same_file() == 1": same directory, so nothing to do
-        if same_directory(oldpath, path) == 0:
+        location = same_directory(oldpath, path)
+        if location == 0:
            # Outside current directory, this is most likely malicious
            logging.error(T("Blocked attempt to create directory %s"), path)
            raise OSError("Refusing to go outside directory")
-        elif same_directory(oldpath, path) == 2:
-            # Sub-directory, so create if does not yet exist:
+
+        # Refuse the admin folder, it is pickle-loaded. Check the whole new path: if the
+        # last element is the admin folder itself, the move below would put the file
+        # inside it, since shutil.move accepts a directory as its target.
+        if points_into_admin_dir(new, oldpath):
+            logging.error(T("Blocked attempt to create directory %s"), path)
+            raise OSError("Refusing to go into admin directory")
+
+        if location == 2:
+            # Sub-directory, create if does not yet exist:
            create_all_dirs(path)

    logging.debug('Renaming "%s" to "%s"', old, new)
@@ -30,6 +30,7 @@ import socket
 import ssl
 import functools
 import copy
+import secrets
 from random import randint
 from xml.sax.saxutils import escape
 from Cheetah.Template import Template
@@ -110,6 +111,7 @@ def secured_expose(
    check_configlock: bool = False,
    check_for_login: bool = True,
    check_api_key: bool = False,
+    api_route: bool = False,
    access_type: int = 4,
 ) -> Callable | str:
    """Wrapper for both cherrypy.expose and login/access check"""
@@ -119,6 +121,7 @@ def secured_expose(
            check_configlock=check_configlock,
            check_for_login=check_for_login,
            check_api_key=check_api_key,
+            api_route=api_route,
            access_type=access_type,
        )

@@ -182,7 +185,7 @@ def secured_expose(

        # Some pages need correct API key
        if check_api_key:
-            if msg := check_apikey(kwargs):
+            if msg := check_apikey(kwargs, api_route=api_route):
                cherrypy.response.status = 403
                if cfg.api_warnings():
                    return msg
@@ -262,8 +265,10 @@ def check_hostname():
    return False


-# Create a more unique ID for each instance
-COOKIE_SECRET = str(randint(1000, 100000) * os.getpid())
+# Per-process secret used to sign login cookies. Regenerated on every start,
+# so sessions do not survive a restart (as before), but with enough entropy
+# that a captured cookie cannot be brute-forced back to the secret.
+COOKIE_SECRET = secrets.token_hex(32)


 def remote_ip_from_xff(xff_ips: list[str]) -> str:
@@ -295,23 +300,25 @@ def set_login_cookie(remove=False, remember_me=False):
    else:
        remote_ip = cherrypy.request.remote.ip

-    cookie_str = utob(str(salt) + remote_ip + COOKIE_SECRET)
-    cherrypy.response.cookie["login_cookie"] = hashlib.sha1(cookie_str).hexdigest()
-    cherrypy.response.cookie["login_cookie"]["path"] = "/"
-    cherrypy.response.cookie["login_cookie"]["httponly"] = 1
-    cherrypy.response.cookie["login_salt"] = salt
-    cherrypy.response.cookie["login_salt"]["path"] = "/"
-    cherrypy.response.cookie["login_salt"]["httponly"] = 1
-
-    # If we want to be remembered
-    if remember_me:
-        cherrypy.response.cookie["login_cookie"]["max-age"] = 3600 * 24 * 14
-        cherrypy.response.cookie["login_salt"]["max-age"] = 3600 * 24 * 14
-
-    # To remove
    if remove:
+        # Never emit a valid cookie/salt pair on logout
+        cherrypy.response.cookie["login_cookie"] = ""
+        cherrypy.response.cookie["login_salt"] = ""
        cherrypy.response.cookie["login_cookie"]["expires"] = 0
        cherrypy.response.cookie["login_salt"]["expires"] = 0
+    else:
+        cookie_str = utob(str(salt) + remote_ip + COOKIE_SECRET)
+        cherrypy.response.cookie["login_cookie"] = hashlib.sha1(cookie_str).hexdigest()
+        cherrypy.response.cookie["login_salt"] = salt
+        # If we want to be remembered
+        if remember_me:
+            cherrypy.response.cookie["login_cookie"]["max-age"] = 3600 * 24 * 14
+            cherrypy.response.cookie["login_salt"]["max-age"] = 3600 * 24 * 14
+
+    cherrypy.response.cookie["login_cookie"]["path"] = "/"
+    cherrypy.response.cookie["login_cookie"]["httponly"] = 1
+    cherrypy.response.cookie["login_salt"]["path"] = "/"
+    cherrypy.response.cookie["login_salt"]["httponly"] = 1


 def check_login_cookie():
@@ -369,31 +376,34 @@ def set_auth(conf):
        conf.update({"tools.auth_basic.on": False})


-def check_apikey(kwargs):
-    """Check API-key or NZB-key
-    Return None when OK, otherwise an error message
-    """
-    mode = kwargs.get("mode", "")
-    name = kwargs.get("name", "")
-
-    # Lookup required access level for the specific api-call
-    req_access = sabnzbd.api.api_level(mode, name)
-    if not check_access(req_access, warn_user=True):
-        return _MSG_ACCESS_DENIED
-
-    # Skip for auth and version calls
-    if mode in ("version", "auth"):
-        return None
-
-    # First check API-key, if OK that's sufficient
+def check_apikey(kwargs, api_route: bool = False):
+    """Check API-key or NZB-key, return None when OK, else an error message.
+    Only the real /api route trusts "mode"; elsewhere it's attacker-controlled,
+    so a valid API-key is always required."""
    key = kwargs.get("apikey")
+
+    if api_route:
+        mode = kwargs.get("mode", "")
+        name = kwargs.get("name", "")
+
+        req_access = sabnzbd.api.api_level(mode, name)
+        if not check_access(req_access, warn_user=True):
+            return _MSG_ACCESS_DENIED
+
+        # Skip for auth and version calls
+        if mode in ("version", "auth"):
+            return None
+
+        # NZB-key suffices for nzb-level calls
+        if req_access == 1 and key and key == cfg.nzb_key():
+            return None
+
+    # A valid API-key is required for everything else
    if not key:
        log_warning_and_ip(
            T("API Key missing, please enter the api key from Config->General into your 3rd party program:")
        )
        return _MSG_APIKEY_REQUIRED
-    elif req_access == 1 and key == cfg.nzb_key():
-        return None
    elif key == cfg.api_key():
        return None
    else:
@@ -492,7 +502,7 @@ class MainPage:
        sabnzbd.shutdown_program()
        return T("SABnzbd shutdown finished")

-    @secured_expose(check_api_key=True, access_type=1)
+    @secured_expose(check_api_key=True, api_route=True, access_type=1)
    def api(self, **kwargs):
        """Redirect to API-handler, we check the access_type in the API-handler"""
        return api_handler(kwargs)
@@ -61,6 +61,7 @@ from sabnzbd.constants import (
    DEF_ARTICLE_CACHE_MAX,
    REPAIR_REQUEST,
    GUESSIT_SORT_TYPES,
+    PP_LOOKUP,
 )
 import sabnzbd.config as config
 import sabnzbd.cfg as cfg
@@ -244,7 +245,7 @@ def cat_pp_script_sanitizer(
    cat: Optional[str] = None,
    pp: Optional[int | str] = None,
    script: Optional[str] = None,
-) -> tuple[Optional[int | str], Optional[str], Optional[str]]:
+) -> tuple[Optional[str], Optional[int], Optional[str]]:
    """Basic sanitizer from outside input to a bit more predictable values"""
    # * and Default are valid values
    if safe_lower(cat) in ("", "none"):
@@ -253,6 +254,11 @@ def cat_pp_script_sanitizer(
    # Cannot use "not pp" because pp can also be 0
    if safe_lower(pp) in ("", "-1", "none"):
        pp = None
+    else:
+        # Only accept a valid pp value (key of PP_LOOKUP)
+        pp = int_conv(pp)
+        if pp not in PP_LOOKUP:
+            pp = None

    # Check for valid script is performed in NzbObject init
    if not script or safe_lower(script) == "default":
@@ -1867,7 +1867,13 @@ def sfv_check(sfvs: list[str], nzo: NzbObject) -> bool:
            if calculated_crc32.get(nzf.filename, "") == sfv_parse_results[file]:
                try:
                    logging.debug("SFV-check will rename %s to %s", nzf.filename, file)
-                    renamer(os.path.join(nzo.download_path, nzf.filename), os.path.join(nzo.download_path, file))
+                    # Untrusted sfv name: normalize separators and contain
+                    file = os.path.normpath(file)
+                    renamer(
+                        os.path.join(nzo.download_path, nzf.filename),
+                        os.path.join(nzo.download_path, file),
+                        create_local_directories=True,
+                    )
                    renames[file] = nzf.filename
                    nzf.filename = file
                    result &= True
@@ -89,6 +89,8 @@ from sabnzbd.filesystem import (
    remove_data,
    get_ext,
    create_work_name,
+    same_directory,
+    points_into_admin_dir,
    RAR_RE,
 )
 from sabnzbd.par2file import FilePar2Info, has_par2_in_filename, analyse_par2, parse_par2_file, is_par2_file
@@ -1454,6 +1456,15 @@ class NzbObject(TryList):
            candidate = f"{base_name}.{num}{ext}"
            path = os.path.join(directory, candidate)
            num += 1
+
+        if subdir := os.path.dirname(candidate):
+            # sanitize_filename() keeps the name local, so this should never trigger
+            if same_directory(directory, os.path.dirname(path)) == 0:
+                raise ValueError("Refusing to write %s outside of %s" % (candidate, directory))
+            if points_into_admin_dir(path, directory):
+                raise ValueError("Refusing to write %s into the admin folder" % candidate)
+            create_all_dirs(os.path.join(directory, subdir))
+
        self.filenames.add(candidate)
        return path

@@ -621,10 +621,10 @@ class RSSRepository:
        """
        Expire G/B links that are not in new_jobs (mark them 'X')

-        Expired links older than 3 days are removed
+        Expired links older than 7 days are removed
        """
        now = datetime.datetime.now(datetime.timezone.utc)
-        limit = int((now - datetime.timedelta(days=3)).timestamp())
+        limit = int((now - datetime.timedelta(days=7)).timestamp())

        if new_urls:
            # Create temporary table for all new URLs
@@ -635,6 +635,22 @@ class RSSRepository:
                placeholders = ",".join(["(?)"] * len(batch))
                self.db.execute(f"INSERT INTO temp_urls(url) VALUES {placeholders}", batch)

+            # Refresh seen_at for everything still listed in the feed. Entries in a terminal
+            # state are skipped during evaluation, so this is the only place they are touched
+            # and without it they would be purged while still present in the feed.
+            self.db.execute(
+                """
+                UPDATE rss
+                SET seen_at = ?
+                WHERE feed = ?
+                  AND url IN (SELECT url FROM temp_urls)
+            """,
+                (
+                    int(datetime.datetime.now(datetime.timezone.utc).timestamp()),
+                    feed,
+                ),
+            )
+
            # Update rss to mark G/B not in temp_urls as X
            self.db.execute(
                """
@@ -686,6 +702,7 @@ class RSSRepository:
    def get_feed_jobs(
        self,
        feed: Optional[str] = None,
+        archive: Optional[bool] = None,
        search: Optional[str] = None,
        states: Optional[list[RSSState]] = None,
    ) -> Generator[ResolvedEntry, Any, None]:
@@ -693,6 +710,11 @@ class RSSRepository:
        command_args = []
        where_clauses = []

+        if archive:
+            where_clauses.append("archived_at IS NOT NULL")
+        else:
+            where_clauses.append("archived_at IS NULL")
+
        if search is not None:
            where_clauses.append("title LIKE ?")
            command_args.append(convert_search(search))
@@ -847,10 +869,13 @@ class RSSRepository:
        )
        return bool(self.db.cursor.fetchone()["found"])

-    def expired_purge(self):
-        """Removed expired links from all feeds"""
+    def purge_removed_feeds(self):
+        """Remove all records of feeds that are no longer configured"""
+        configured = set(config.get_rss())
        for feed in self.get_feeds():
-            self.remove_obsolete(feed)
+            if feed not in configured:
+                logging.debug("Purging records of removed feed %s", feed)
+                self.clear_feed(feed)

    def import_rss_records(self):
        """Migrate old RSS database"""
@@ -981,7 +1006,6 @@ class RSSReader:
                    new_links.add(entry.link)

                    downloaded = self._process_entry(
-                        repo,
                        feed_entry=entry,
                        filters=filters,
                        first=first,
@@ -998,7 +1022,8 @@ class RSSReader:
            if new_downloads and cfg.email_rss() and not force:
                emailer.rss_mail(feed, new_downloads)

-            repo.remove_obsolete(feed, new_links, purge_downloaded=True)
+            if readout:
+                repo.remove_obsolete(feed, new_links, purge_downloaded=True)

        return ""

@@ -1119,8 +1144,6 @@ class RSSReader:

    def _process_entry(
        self,
-        repo: RSSRepository,
-        *,
        feed_entry: ResolvedEntry,
        filters: FeedConfig,
        first: bool,
@@ -1178,8 +1201,9 @@ class RSSReader:
            initial_scan=initial_scan,
        )

-        repo.upsert(resolved_entry)
-        self.enqueue_download(repo, resolved_entry)
+        with sabnzbd.rss.rss_repository() as repo:
+            repo.upsert(resolved_entry)
+            self.enqueue_download(repo, resolved_entry)

        return bool(evaluation.matched and should_download)

@@ -1266,10 +1290,10 @@ def special_rss_site(url: str) -> bool:
    return bool(cfg.rss_filenames() or match_str(url, cfg.rss_odd_titles()))


-def expired_purge():
-    """Purge links older than 3 days"""
+def purge_removed_feeds():
+    """Purge records of feeds that are no longer configured"""
    with rss_repository() as repo:
-        repo.expired_purge()
+        repo.purge_removed_feeds()


@contextmanager
@@ -6,5 +6,5 @@
 # You MUST use double quotes (so " and not ')
 # Do not forget to update the appdata file for every major release!

-__version__ = "5.1.0RC2"
-__baseline__ = "unknown"
+__version__ = "5.1.2"
+__baseline__ = "b53a60f92d17ea49b2cdef310b2d359bba1858d8"
@@ -38,7 +38,7 @@ import sabnzbd
 import sabnzbd.cfg
 from sabnzbd import cfg
 import sabnzbd.filesystem as filesystem
-from sabnzbd.constants import DEF_FOLDER_MAX, DEF_FILE_MAX
+from sabnzbd.constants import DEF_FOLDER_MAX, DEF_FILE_MAX, JOB_ADMIN

 # Set the global uid for fake filesystems to a non-root user;
 # by default this depends on the user running pytest.
@@ -123,6 +123,77 @@ class TestFileFolderNameSanitizer:
        assert filesystem.sanitize_filename("../") == ".._"
        assert filesystem.sanitize_filename("../test") == ".._test"

+    @pytest.mark.parametrize("platform", ["win32", "macos", "linux"])
+    @pytest.mark.platform()
+    def test_file_allow_subdirs(self, platform):
+        """Par2 uses "/" to separate sub-directories, no matter which platform created the set"""
+        assert filesystem.sanitize_filename("sub/test.rar", allow_subdirs=True) == os.path.join("sub", "test.rar")
+        assert filesystem.sanitize_filename("sub/deeper/test.rar", allow_subdirs=True) == os.path.join(
+            "sub", "deeper", "test.rar"
+        )
+        # No sub-directory at all, or nothing but separators
+        assert filesystem.sanitize_filename("test.rar", allow_subdirs=True) == "test.rar"
+        assert filesystem.sanitize_filename("a//b.rar", allow_subdirs=True) == os.path.join("a", "b.rar")
+        assert filesystem.sanitize_filename("sub/./test.rar", allow_subdirs=True) == os.path.join("sub", "test.rar")
+        # Every part is sanitized on its own, chr(0) is illegal on all platforms
+        assert filesystem.sanitize_filename("sub" + chr(0) + "1/test" + chr(0) + "2.rar", allow_subdirs=True) == (
+            os.path.join("sub_1", "test_2.rar")
+        )
+
+    @pytest.mark.parametrize(
+        "hostile_name",
+        [
+            "/test.rar",
+            "//test.rar",
+            "../test.rar",
+            "../../../../../../etc/shadow",
+            "sub/../../test.rar",
+            "sub/../../../sub/test.rar",
+            "./../test.rar",
+            "../..",
+            "../",
+            "/",
+            "//",
+            "/../",
+            "...",
+            "....",
+        ],
+    )
+    @pytest.mark.parametrize("platform", ["win32", "macos", "linux"])
+    @pytest.mark.platform()
+    def test_file_allow_subdirs_cannot_escape(self, platform, hostile_name):
+        """Whatever the par2 claims, the result has to stay inside the folder it is used in.
+        Joining it onto any base directory must never point above that base."""
+        result = filesystem.sanitize_filename(hostile_name, allow_subdirs=True)
+
+        assert result, "an empty result would resolve to the base directory itself"
+        assert not os.path.isabs(result)
+        assert os.pardir not in result.split(os.sep)
+
+        # The real test: it cannot climb out of whatever it gets joined to
+        base = os.path.join(os.sep + "downloads", "incomplete", "job")
+        resolved = os.path.normpath(os.path.join(base, result))
+        assert resolved.startswith(base + os.sep), "%s escaped to %s" % (hostile_name, resolved)
+
+    @pytest.mark.parametrize(
+        "hostile_name",
+        [
+            JOB_ADMIN,
+            JOB_ADMIN + "/__verified__",
+            JOB_ADMIN.lower() + "/__verified__",
+            "sub/" + JOB_ADMIN + "/__verified__",
+            JOB_ADMIN + "/deeper/__verified__",
+        ],
+    )
+    @pytest.mark.parametrize("platform", ["win32", "macos", "linux"])
+    @pytest.mark.platform()
+    def test_file_allow_subdirs_cannot_enter_admin(self, platform, hostile_name):
+        """The admin folder is pickle-loaded, so a par2 name must never point into it"""
+        result = filesystem.sanitize_filename(hostile_name, allow_subdirs=True)
+
+        assert result, "an empty result would resolve to the base directory itself"
+        assert JOB_ADMIN.lower() not in result.lower().split(os.sep)
+
    @pytest.mark.platform("linux")
    def test_folder_illegal_chars_linux(self):
        assert filesystem.sanitize_foldername('test"aftertest') == "test_aftertest"
@@ -443,6 +514,59 @@ class TestSameDirectory:
        assert 0 == filesystem.same_directory("/test/../Home", "/home")


+class TestPointsIntoAdminDir:
+    def test_by_name(self, tmp_path):
+        base = str(tmp_path)
+        assert filesystem.points_into_admin_dir(os.path.join(base, JOB_ADMIN), base)
+        assert filesystem.points_into_admin_dir(os.path.join(base, JOB_ADMIN, "__verified__"), base)
+        assert filesystem.points_into_admin_dir(os.path.join(base, "sub", JOB_ADMIN, "__verified__"), base)
+
+    def test_regular_names_are_left_alone(self, tmp_path):
+        base = str(tmp_path)
+        assert not filesystem.points_into_admin_dir(os.path.join(base, "testfile.rar"), base)
+        assert not filesystem.points_into_admin_dir(os.path.join(base, "sub", "testfile.rar"), base)
+        # Only a full part counts, not a name that merely starts with it
+        assert not filesystem.points_into_admin_dir(os.path.join(base, JOB_ADMIN + "-data", "testfile.rar"), base)
+
+    def test_link_cannot_hide_it(self, tmp_path):
+        """On Windows an NTFS 8.3 alias ("__ADMI~1") points at the admin folder under a
+        different name, exactly like a link does here, so the name cannot be trusted"""
+        base = str(tmp_path)
+        admin_dir = os.path.join(base, JOB_ADMIN)
+        os.mkdir(admin_dir)
+        linkname = os.path.join(base, "notadmin")
+        os.symlink(admin_dir, linkname)
+
+        assert filesystem.points_into_admin_dir(linkname, base)
+        assert filesystem.points_into_admin_dir(os.path.join(linkname, "__verified__"), base)
+
+    @pytest.mark.skipif(not sys.platform.startswith("win"), reason="NTFS 8.3 aliases only exist on Windows")
+    def test_ntfs_8dot3_alias_cannot_hide_it(self, tmp_path):
+        """The real thing the link above stands in for: NTFS keeps an 8.3 alias for every
+        long name, so "__ADMI~1" reaches the admin folder without ever spelling it out"""
+        import win32api
+
+        base = str(tmp_path)
+        admin_dir = os.path.join(base, JOB_ADMIN)
+        os.mkdir(admin_dir)
+
+        # Ask the filesystem for the alias instead of assuming what it generated
+        alias = os.path.basename(win32api.GetShortPathName(admin_dir))
+        if alias.lower() == JOB_ADMIN.lower():
+            pytest.skip("8.3 name creation is disabled on this volume")
+
+        assert filesystem.points_into_admin_dir(os.path.join(base, alias), base)
+        assert filesystem.points_into_admin_dir(os.path.join(base, alias, "__verified__"), base)
+
+        # And the rename that the alias was meant to sneak through has to fail
+        filename = os.path.join(base, "myfile.txt")
+        Path(filename).touch()
+        with pytest.raises(OSError):
+            filesystem.renamer(filename, os.path.join(base, alias, "__verified__"), create_local_directories=True)
+        assert os.path.isfile(filename)
+        assert not os.listdir(admin_dir)
+
+
 class TestFirstExistingPath:
    def test_existing_path(self, tmp_path):
        assert filesystem.first_existing_path(str(tmp_path)) == str(tmp_path)
@@ -1203,6 +1327,41 @@ class TestRenamer:
        assert os.path.isfile(filename)
        assert not os.path.isfile(newfilename)

+        # ... renaming into the admin folder is not allowed either
+        admin_dir = os.path.join(dirname, JOB_ADMIN)
+        os.mkdir(admin_dir)
+        Path(filename).touch()
+        newfilename = os.path.join(admin_dir, "__verified__")
+        try:
+            filesystem.renamer(filename, newfilename, create_local_directories=True)
+        except Exception:
+            pass
+        assert os.path.isfile(filename)
+        assert not os.path.isfile(newfilename)
+
+        # ... nor is naming the admin folder itself: a move into an existing directory
+        # keeps the old basename, so this would end up inside the admin folder as well
+        Path(filename).touch()
+        try:
+            filesystem.renamer(filename, admin_dir, create_local_directories=True)
+        except Exception:
+            pass
+        assert os.path.isfile(filename)
+        assert not os.listdir(admin_dir)
+
+        # ... and not under another name that resolves to it, such as a link. On Windows
+        # an NTFS 8.3 alias ("__ADMI~1") reaches the admin folder the very same way.
+        linkname = os.path.join(dirname, "notadmin")
+        os.symlink(admin_dir, linkname)
+        Path(filename).touch()
+        try:
+            filesystem.renamer(filename, os.path.join(linkname, "__verified__"), create_local_directories=True)
+        except Exception:
+            pass
+        assert os.path.isfile(filename)
+        assert not os.listdir(admin_dir)
+        os.remove(linkname)
+
        # Cleanup working directory
        shutil.rmtree(dirname)

@@ -228,3 +228,57 @@ class TestInterfaceFunctions:
            assert interface.remote_ip_from_xff(xff_ips) is expected_result

        _func()
+
+    @pytest.mark.config({"api_key": "the_real_api_key", "nzb_key": "the_real_nzb_key"})
+    @pytest.mark.parametrize(
+        "api_route, kwargs, expected",
+        [
+            # /api route: version/auth public, NZB-key valid for nzb-level calls
+            (True, {"mode": "version"}, None),
+            (True, {"mode": "auth"}, None),
+            (True, {"mode": "addfile", "apikey": "the_real_nzb_key"}, None),
+            (True, {"mode": "queue", "apikey": "the_real_api_key"}, None),
+            (True, {"mode": "queue"}, interface._MSG_APIKEY_REQUIRED),
+            (True, {"mode": "queue", "apikey": "wrong"}, interface._MSG_APIKEY_INCORRECT),
+            # Web-ui routes must ignore 'mode': no version/auth or NZB-key bypass
+            (False, {"mode": "version"}, interface._MSG_APIKEY_REQUIRED),
+            (False, {"mode": "auth"}, interface._MSG_APIKEY_REQUIRED),
+            (False, {"mode": "addfile", "apikey": "the_real_nzb_key"}, interface._MSG_APIKEY_INCORRECT),
+            (False, {"apikey": "the_real_api_key"}, None),
+            (False, {"mode": "version", "apikey": "the_real_api_key"}, None),
+            (False, {"apikey": "wrong"}, interface._MSG_APIKEY_INCORRECT),
+            (False, {}, interface._MSG_APIKEY_REQUIRED),
+        ],
+    )
+    def test_check_apikey_ignores_mode_off_api_route(self, api_route, kwargs, expected):
+        """'mode' is only trusted on the real /api route, not on web-ui handlers."""
+        cherrypy.request.remote.ip = "127.0.0.1"
+        cherrypy.request.headers.update({"X-Forwarded-For": None})
+        cherrypy.request.remote_label = "127.0.0.1 [test]"
+        assert interface.check_apikey(kwargs, api_route=api_route) == expected
+
+    @pytest.mark.config({"verify_xff_header": False})
+    def test_logout_does_not_leak_valid_cookie(self):
+        """A logout must never emit a cookie/salt pair that passes check_login_cookie.
+        The Set-Cookie header is readable regardless of its expiry, so leaking valid
+        values there is an authentication bypass (harvest via logout, then replay)."""
+        cherrypy.request.remote.ip = "10.11.12.13"
+        cherrypy.request.headers.update({"X-Forwarded-For": None})
+
+        # Sanity check: a real login produces a cookie that validates
+        cherrypy.response.cookie.clear()
+        interface.set_login_cookie()
+        cherrypy.request.cookie["login_cookie"] = cherrypy.response.cookie["login_cookie"].value
+        cherrypy.request.cookie["login_salt"] = cherrypy.response.cookie["login_salt"].value
+        assert interface.check_login_cookie() is True
+
+        # Logout must blank out the values, not emit a working hash/salt
+        cherrypy.response.cookie.clear()
+        interface.set_login_cookie(remove=True)
+        assert cherrypy.response.cookie["login_cookie"].value == ""
+        assert cherrypy.response.cookie["login_salt"].value == ""
+
+        # Replaying whatever the logout response carried must fail authentication
+        cherrypy.request.cookie["login_cookie"] = cherrypy.response.cookie["login_cookie"].value
+        cherrypy.request.cookie["login_salt"] = cherrypy.response.cookie["login_salt"].value
+        assert interface.check_login_cookie() is False
@@ -109,16 +109,26 @@ class TestMisc:
            (None, None, None, (None, None, None)),
            ("", "", "", (None, None, None)),
            ("none", "-1", "default", (None, None, None)),
-            ("SomeCategory", "5", "SomeScript", ("SomeCategory", "5", "SomeScript")),
+            ("SomeCategory", "1", "SomeScript", ("SomeCategory", 1, "SomeScript")),
            ("none", 0, "default", (None, 0, None)),
            ("Movies", "", "default", ("Movies", None, None)),
-            ("", "10", "default", (None, "10", None)),
-            ("none", "15", "", (None, "15", None)),
            ("none", 0, "Default", (None, 0, None)),
            ("other", "-1", "Default", ("other", None, None)),
            ("none", "None", "default", (None, None, None)),
            ("some", "none", "script", ("some", None, "script")),
            ("none", "NONE", "Default", (None, None, None)),
+            # pp must be a PP_LOOKUP key or None
+            ("none", "2", "default", (None, 2, None)),
+            ("none", 3, "default", (None, 3, None)),
+            # Out-of-range ints are invalid
+            ("", "10", "default", (None, None, None)),
+            ("none", "15", "", (None, None, None)),
+            ("none", 4, "default", (None, None, None)),
+            # Non-numeric never passes as a string
+            ("none", "-c", "default", (None, 0, None)),
+            ("none", "echo pwned", "default", (None, 0, None)),
+            ("none", "2; rm -rf /", "default", (None, 0, None)),
+            ("none", "1.5", "default", (None, 0, None)),
        ],
    )
    def test_cat_pp_script_sanitizer(self, cat, pp, script, expected):
@@ -51,8 +51,31 @@ class TestNewsUnpackFunctions:
        assert not newsunpack.is_sfv_file("tests/data/only_comments.sfv")
        assert not newsunpack.is_sfv_file("tests/data/random.bin")

-    def test_is_sevenfile(self):
-        # False, because the command is not set
+    def test_sfv_check_blocks_path_traversal(self, tmp_path):
+        """A traversing SFV filename must not move a file out of the job directory"""
+        download_path = str(tmp_path)
+        obfuscated_name = "6f1ed002ab5595859014ebf0951522d9"
+        obfuscated_path = os.path.join(download_path, obfuscated_name)
+        with open(obfuscated_path, "wb") as test_file:
+            test_file.write(b"payload")
+
+        # SFV entry with matching crc32 but a traversing target name
+        sfv_path = os.path.join(download_path, "check.sfv")
+        with open(sfv_path, "w") as sfv_file:
+            sfv_file.write("../escaped.bin deadbeef\n")
+
+        nzf = mock.Mock(filename=obfuscated_name, filepath=obfuscated_path, crc32=0xDEADBEEF)
+        nzo = mock.Mock(download_path=download_path, finished_files=[nzf])
+
+        assert newsunpack.sfv_check([sfv_path], nzo) is False
+        assert not os.path.exists(os.path.join(download_path, os.pardir, "escaped.bin"))
+        assert os.path.exists(obfuscated_path)
+
+    def test_is_sevenfile(self, monkeypatch):
+        # False, because the command is not set. Force it explicitly: SEVENZIP_COMMAND
+        # is a module global that another test in this class may have populated via
+        # find_programs(), and under pytest-xdist tests share no ordering guarantee.
+        monkeypatch.setattr(newsunpack, "SEVENZIP_COMMAND", None)
        assert not newsunpack.SEVENZIP_COMMAND
        assert not newsunpack.is_sevenfile("tests/data/test_7zip/testfile.7z")

@@ -65,6 +88,7 @@ class TestNewsUnpackFunctions:
        assert newsunpack.is_sevenfile("tests/data/test_7zip/testfile.7z")

    def test_sevenzip(self):
+        newsunpack.find_programs(".")
        testzip = newsunpack.SevenZip("tests/data/test_7zip/testfile.7z")
        assert testzip.namelist() == ["My_Test_Download.bin"]
        # Basic check that we can get data from the 7zip
@@ -734,9 +734,15 @@ class TestRSS:
        assert job_after_clear.archived_at is not None
        assert job_after_clear.is_downloaded

-        # get_jobs should return all jobs for a feed
+        # get_jobs should return all non-archived jobs for a feed
        jobs_from_get_jobs = list(repo.get_feed_jobs(feed=feed))
-        assert {j.link for j in jobs_from_get_jobs} == set(links_by_feed[feed])
+        assert {j.link for j in jobs_from_get_jobs} == {
+            job_link for job_link in links_by_feed[feed] if job_link is not link
+        }
+
+        # get_jobs archive should return only archived jobs for a feed
+        jobs_from_get_jobs = list(repo.get_feed_jobs(feed=feed, archive=True))
+        assert {j.link for j in jobs_from_get_jobs} == {link}

        # is_duplicate should detect similar jobs in other feeds
        duplicate_candidate = ResolvedEntry(
@@ -775,7 +781,7 @@ class TestRSS:

        now = datetime.datetime.now(datetime.timezone.utc)
        age = now - datetime.timedelta(weeks=52)
-        old_seen_at = now - datetime.timedelta(days=4)
+        old_seen_at = now - datetime.timedelta(days=8)
        new_seen_at = now - datetime.timedelta(days=1)

        # Old good item that should be kept because it is part of the new_urls set
@@ -1039,3 +1045,123 @@ class TestRSS:

        # Shared link must only appear once
        assert links == {shared_link, a_only_link, b_only_link}
+
+    def test_purge_removed_feeds_only_drops_unconfigured_feeds(self, tmp_rss):
+        """Records should only be dropped for feeds that are no longer configured."""
+        repo, _reader = tmp_rss
+        configured_feed = "ConfiguredFeed"
+        removed_feed = "RemovedFeed"
+
+        self.setup_rss(configured_feed, "http://example.test/rss.xml")
+
+        age = datetime.datetime.now(datetime.timezone.utc) - datetime.timedelta(weeks=52)
+        old_seen_at = datetime.datetime.now(datetime.timezone.utc) - datetime.timedelta(days=30)
+        for feed in (configured_feed, removed_feed):
+            repo.upsert(
+                ResolvedEntry(
+                    feed=feed,
+                    link=f"http://example.test/{feed}/job",
+                    title=f"{feed} job",
+                    infourl=None,
+                    size=10,
+                    age=age,
+                    seen_at=old_seen_at,
+                    season=1,
+                    episode=1,
+                    category=None,
+                    state=RSSState.GOOD,
+                )
+            )
+
+        repo.purge_removed_feeds()
+
+        assert set(repo.get_feeds()) == {configured_feed}
+
+    def test_process_feed_without_readout_keeps_stored_jobs(self, httpserver: HTTPServer, tmp_rss):
+        """Replaying stored jobs (readout=False) must not expire or purge anything."""
+        repo, reader = tmp_rss
+        feed_name = "NoReadoutFeed"
+        feed_xml = """<?xml version="1.0" encoding="utf-8"?>
+        <rss version="2.0">
+          <channel>
+            <title>NoReadout</title>
+            <item>
+                <title>New.Show.S01E01.720p</title>
+                <link>http://example.test/no-readout/current</link>
+                <guid>http://example.test/info/no-readout-current</guid>
+                <category>tv</category>
+                <pubDate>Wed, 01 Jan 2025 00:00:00 GMT</pubDate>
+            </item>
+          </channel>
+        </rss>
+        """
+        httpserver.expect_request("/rss_no_readout.xml").respond_with_data(feed_xml, content_type="application/rss+xml")
+        self.setup_rss(feed_name, httpserver.url_for("/rss_no_readout.xml"))
+
+        now = datetime.datetime.now(datetime.timezone.utc)
+        old_url = "http://example.test/no-readout/expired"
+        repo.upsert(
+            ResolvedEntry(
+                feed=feed_name,
+                link=old_url,
+                title="Old.Show.S01E01.720p",
+                infourl=None,
+                size=10,
+                age=now - datetime.timedelta(weeks=52),
+                seen_at=now - datetime.timedelta(days=8),
+                season=1,
+                episode=1,
+                category=None,
+                state=RSSState.EXPIRED,
+            )
+        )
+
+        assert reader.process_feed(feed_name, readout=False) == ""
+        assert repo.find_job_by_url(feed_name, old_url) is not None
+
+        # A real readout does not find the link anymore, so it gets purged
+        assert reader.process_feed(feed_name, readout=True) == ""
+        assert repo.find_job_by_url(feed_name, old_url) is None
+
+    def test_downloaded_item_still_in_feed_is_not_redownloaded(self, httpserver: HTTPServer, tmp_rss, mocker):
+        """An item that stays in the feed must survive the retention period and not be grabbed twice."""
+        repo, reader = tmp_rss
+        feed_name = "LongLivedFeed"
+        link = "http://example.test/long-lived"
+        feed_xml = f"""<?xml version="1.0" encoding="utf-8"?>
+        <rss version="2.0">
+          <channel>
+            <title>LongLived</title>
+            <item>
+                <title>Show.S01E01.720p</title>
+                <link>{link}</link>
+                <guid>http://example.test/info/long-lived</guid>
+                <category>tv</category>
+                <pubDate>Wed, 01 Jan 2025 00:00:00 GMT</pubDate>
+            </item>
+          </channel>
+        </rss>
+        """
+        httpserver.expect_request("/rss_long_lived.xml").respond_with_data(feed_xml, content_type="application/rss+xml")
+        self.setup_rss(feed_name, httpserver.url_for("/rss_long_lived.xml"))
+
+        add_url = mocker.patch("sabnzbd.urlgrabber.add_url")
+        assert reader.process_feed(feed_name, download=True, force=True) == ""
+        assert add_url.call_count == 1
+        assert repo.find_job_by_url(feed_name, link).state is RSSState.DOWNLOADED
+
+        # Pretend the item was downloaded longer ago than the retention period, while
+        # it is still being served by the feed
+        stale = int((datetime.datetime.now(datetime.timezone.utc) - datetime.timedelta(days=30)).timestamp())
+        repo.db.execute("UPDATE rss SET seen_at = ? WHERE feed = ?", (stale, feed_name))
+
+        # Still being listed should refresh seen_at instead of purging the job
+        assert reader.process_feed(feed_name, download=True) == ""
+        job = repo.find_job_by_url(feed_name, link)
+        assert job is not None
+        assert job.state is RSSState.DOWNLOADED
+        assert job.seen_at.timestamp() > stale
+
+        # And it must not be picked up as a new job on the next scans
+        assert reader.process_feed(feed_name, download=True) == ""
+        assert add_url.call_count == 1