- Fix SUBTREE→BASE scope in _fetch_user_attributes (security)
- Remove is_ldap_user threading from all 8 media client interfaces;
set flag after join via workflow-level User.query.update instead
- Use find_user_dn (search-based) instead of build_user_dn (concatenation)
in delete_user and reset_user_password for robustness
- Wrap all user-facing strings in _() for i18n in ldap_auth.py
- Fix username fallback from hardcoded "wizarr" to unique per-user
- Return failure from _update_existing_user when password update fails
- Replace dynamic Tailwind classes with explicit conditionals in alert
- Add stale group cleanup and upsert in sync_ldap_groups
- Remove fake @ldap.local email fallback in user_sync
Security:
- Fix XSS in HTMX responses by replacing f-string HTML with Jinja partials
- Fix TLS verify_cert not being applied (add Tls config to ldap3 Server)
- Fix password_hash NOT NULL conflict for LDAP-only admin accounts
- Fix should_create_ldap_user defaulting to True for existing invitations
Correctness:
- Fix DN reconstruction fragility using escape_rdn for special characters
- Fix connection leaks with try/finally in all LDAPClient methods
- Fix sync interval logic (check FLASK_ENV not WIZARR_ENABLE_SCHEDULER)
- Only register LDAP sync job when LDAP is actually configured
- Make find_user_dn and service_connection public API methods
Cleanup:
- Squash 5 incremental LDAP migrations into single 20251226_add_ldap_support
- Remove duplicate imports/queries in auth routes
- Replace f-string logging with %s formatting
- Extract inline HTML to Jinja template partials
- Add support for inviting users to multiple media servers simultaneously
- Implement Jellyfin-specific invite options (Allow Downloads, Allow Live TV)
- Add server type detection and conditional UI rendering in invite form
- Create new database migration for Jellyfin server options
- Update invite service to handle multi-server invitations
- Add server-specific validation and error handling
- Enhance user management with server-specific permissions
- Update templates to show server-specific invite options
- Add middleware support for multi-server authentication
- Improve settings forms with server type-specific fields
Breaking changes:
- Invite form now requires server selection
- User permissions are now server-specific
- Database schema updated for multi-server support
The Plex Downloads and Plex TV checkboxes in settings were not saving correctly. This is because it was an issue with the booleans being stringified in the db and not being converted back properly. Now they are saved as "true"/"false" in the db and then converted back to booleans in the _load_settings() function. This was the best fix I could come up with, but let me know if you have any better ideas.
