0xsysr3ll
ca7b7885d3
fix(settings): prefer typeorm over raw sql queries
2026-03-30 21:55:40 +02:00
0xsysr3ll
15f96e8776
fix: quote columns
2026-03-30 21:55:39 +02:00
0xsysr3ll
e05c90fb67
fix(settings): correct SQL syntax for jellyfinUserId condition
2026-03-30 21:55:37 +02:00
0xsysr3ll
72cc621176
fix(settings): refine media server switch logic and update user instructions
2026-03-30 21:55:35 +02:00
0xsysr3ll
a2e920bb3e
feat(settings): make code more dry
2026-03-30 21:55:34 +02:00
0xsysr3ll
3df674178d
fix(settings): update deprecation messages and improve media server switch logic
2026-03-30 21:55:32 +02:00
0xsysr3ll
2b11ca5f88
feat(settings): log out all users after successful switch
2026-03-30 21:54:52 +02:00
0xsysr3ll
b85846714b
fix(auth): update token storage logic for Plex when using Jellyfin or Emby as main server
2026-03-30 21:54:51 +02:00
0xsysr3ll
45e6786ca3
fix(userSettings): improve account linking logic to prevent conflicts with existing users
2026-03-30 21:54:50 +02:00
0xsysr3ll
f7a86642f7
fix(settings): remove condition for user plexId in update query
2026-03-30 21:54:49 +02:00
0xsysr3ll
bfe09d6969
feat(settings): add switching logic to support Jellyfin and Emby transitions
2026-03-30 21:54:48 +02:00
0xsysr3ll
16988da67e
fix(MediaSubscriber): remove optional chaining for status checks
2026-03-30 21:54:47 +02:00
0xsysr3ll
08c3c2771f
fix(settings): remove unnecessary user ID condition for plex and jellyfin unlinking
2026-03-30 21:54:45 +02:00
0xsysr3ll
816c869d8a
fix(settings): allow jellyfin/emby unlinking before migration
2026-03-30 21:54:43 +02:00
0xsysr3ll
8f4f878661
feat(auth, settings): enforce admin permissions
2026-03-30 21:54:40 +02:00
0xsysr3ll
bc1c136b36
feat(settings): add endpoint and UI for switching media server
2026-03-30 21:54:32 +02:00
0xsysr3ll
993ae4c58e
feat(blocklist): add support for collections ( #1841 )
2026-03-30 06:19:45 +08:00
Shyam
56b79ff38c
feat(i18n): add Estonian language support ( #2611 )
2026-03-29 02:54:52 +08:00
Angelo Olivera
865396fd28
fix(watchlist-sync): handle empty watchlists on PostgreSQL ( #2718 )
2026-03-23 18:55:40 +05:00
0xsysr3ll
eaf397a021
feat(userlist): add sortable columns to User List ( #1615 )
2026-03-21 04:45:00 +05:00
YakGravity
10f23f009d
fix(jellyfin-scanner): add TheMovieDb provider fallback for Jellyfin scanner ( #2605 )
2026-03-17 16:18:43 +01:00
0xsysr3ll
90d407d410
fix(movie,tv): respect display language for trailers ( #2674 )
2026-03-16 18:29:40 +01:00
Michael Thomas
36243a0deb
chore: upgrade to eslint v9 ( #2574 )
2026-03-16 21:12:30 +05:00
fallenbagel
6c52a2f3ad
fix(settings): serialize settings writes and prevent partial overwrites ( #2696 )
2026-03-16 11:29:41 +01:00
fallenbagel
0be18968b4
fix: disambiguate tmdb ids by media type across lookups ( #2577 )
2026-03-14 23:47:21 +05:00
Gauthier
d25d0ca570
fix(requests): mark requests as completed when media is already available ( #2462 )
...
Co-authored-by: fallenbagel <98979876+Fallenbagel@users.noreply.github.com >
2026-03-14 17:45:41 +05:00
0xsysr3ll
f40323c7c5
fix(migration): repair postgres blocklist id sequence ( #2686 )
2026-03-12 21:58:11 +05:00
0xsysr3ll
dccdc95927
feat(i18n): add Luxembourgish language support ( #2671 )
2026-03-12 19:07:58 +05:00
Michael Thomas
8563362588
test: support server-side unit testing ( #2485 )
2026-03-12 18:39:41 +05:00
0xsysr3ll
40edaea43f
feat(i18n): add Vietnamese language support ( #2670 )
2026-03-12 15:59:56 +05:00
Jerra94
ff4ab21a9e
feat(webhook): add jellyfinMediaId and jellyfinUserId to webhook notification ( #1959 )
2026-03-06 12:04:13 +01:00
0xsysr3ll
15489486cb
fix(plex): set 4K Plex URLs whenever ratingKey4k is set ( #2635 )
2026-03-05 22:51:42 +01:00
bogo22
4ce0db1959
feat(trending): add filter options ( #2137 )
...
Signed-off-by: Florian Hoech <code@florians-web.de >
2026-03-05 15:24:55 +05:00
0xsysr3ll
3152f727ef
feat(notifications): webhook custom headers ( #2230 )
...
Signed-off-by: 0xsysr3ll <0xsysr3ll@pm.me >
2026-03-05 15:23:47 +05:00
fallenbagel
9ec3d585d1
fix(email): correctly classify final MIME header in PGP email encryption ( #2618 )
2026-03-04 03:17:56 +05:00
fallenbagel
a16d0464a6
fix(issues): update issue timestamp when adding comments ( #2616 )
2026-03-02 12:35:18 +01:00
Lachlan Wisdom
3557745b62
feat(jellyfin): allow Jellyfin Guids with dashes for import-from-jellyfin endpoint ( #2340 )
2026-03-02 16:22:33 +05:00
0xsysr3ll
c23117eb6b
feat(requests): mark requests as failed when Radarr/Sonarr unreachable ( #2171 )
...
Signed-off-by: 0xsysr3ll <0xsysr3ll@pm.me >
2026-03-02 04:41:27 +05:00
fallenbagel
61e0377361
feat(notifications): add priority setting for ntfy agent ( #2306 )
2026-03-02 04:37:57 +05:00
0xsysr3ll
001f6b1a34
fix(media): exclude null mediaAddedAt entries ( #2607 )
2026-03-01 22:51:51 +05:00
fallenbagel
5c34c91257
feat(sonarr): add monitorNewItems option to sonarr settings & modal ( #2071 )
2026-02-28 02:08:44 +05:00
ventiph
a2d1e1b06f
refactor(notifications): move event from author to title field in Discord Embed ( #2119 )
2026-02-28 01:48:11 +05:00
Rin
e086081b19
fix(proxy): add path validation guardrail to imageproxy ( #2531 )
2026-02-28 00:14:05 +05:00
Gauthier
946bdecec5
Merge commit from fork
...
This PR fixes a security issue where authenticated users could access and modify data belonging to
other users. The isOwnProfileOrAdmin() middleware was missing from several push subscription API
routes. As a result, any authenticated user on the instance could manipulate the userId parameter in
the URL to view or delete the push subscriptions of other users.
2026-02-28 00:58:50 +08:00
fallenbagel
4f089b29d0
Merge commit from fork
...
Add ownership check to GET /api/v1/user/:id so the full user object(including eager-loaded settings
with notification credentials) is onlyreturned to the user themselves or MANAGE_USERS admins. All
otherauthenticated users receive a stripped response (which is the intended behaviour as
https://github.com/sct/overseerr/pull/3695#issuecomment-1817827774 ). Also expands
User.filteredFields to strip sensitive fileds to prevent leaking credentials
2026-02-28 00:58:28 +08:00
fallenbagel
4ae2068409
Merge commit from fork
...
Fix a logic flaw in the jellyfin auth guard that allowed unauthenticated users to register accounts
on Plex-configured instances by authenticating against an attacker-controlled Jellyfin server.
2026-02-28 00:36:17 +08:00
Pierre Spring
10ea21b20f
feat: self-host font for better privacy ( #2540 )
2026-02-27 10:48:48 +01:00
Kenshin9977
55776ea24f
fix(radarr): trigger search for existing monitored movies without files ( #2391 )
2026-02-25 15:58:05 +01:00
0xsysr3ll
947f70c3d7
fix(watch-data): use sentinel values to avoid invalid SQL syntax ( #2552 )
2026-02-23 21:24:48 +01:00
fallenbagel
3bcb4da1e5
feat(servarr-api): make Servarr API request timeout configurable ( #2556 )
2026-02-23 00:32:31 +01:00
