nas/MoviePilot
1
0
Fork 0
mirror of https://github.com/jxxghp/MoviePilot.git synced 2026-11-01 04:47:03 +08:00
Code Issues Packages Projects Releases Wiki Activity
10,701 Commits 4 Branches 378 Tags
v3
Commit Graph

8067 Commits

Author SHA1 Message Date
jxxghp
6c17ba4fa1 fix(torrent): follow first-download confirmation redirects 2026-10-31 22:30:30 +08:00
jxxghp
ae6270e655 Merge pull request #7257 from qingyukb/codex/security-web-agent-file-owner 2026-10-31 22:08:06 +08:00
jxxghp
10e9ade7de fix(site): preserve text category IDs and replay resource configs 2026-10-31 17:25:29 +08:00
qingyukb
aea8cf11c4 fix: 按用户隔离 Web 智能助手临时附件 2026-10-31 17:04:21 +08:00
LIN student
4dfcac8d04 fix(site): skip search parameters when listing site categories 
- 站点分类接口只收集分类配置中的列表分组和字典项；field、delimiter、
  param 等搜索请求参数不再被当成分类逐字符返回，避免响应校验失败导致
  站点分类请求 500。
- 补充带搜索参数和非法分类项的回归测试，并校验结果符合接口响应模型。

Refs #7250

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-31 16:02:40 +08:00
jxxghp
a432906475 fix(download): 按所选剧集组重新计算缺失季集 (#7253) 
* fix(download): recalculate missing episodes for episode groups

Refs #7252

* test: align episode group regression import spacing
 2026-10-31 10:32:50 +08:00
jxxghp
f5bd3458a6 fix(subscribe): restore strict media identity checks 2026-10-30 22:36:51 +08:00
jxxghp
674c4aef64 Merge pull request #7248 from ranzhigg/security/rce-hardening-v322 2026-10-30 17:44:40 +08:00
ranzhigg
80a76dee56 fix(storage): bind management operations to verified targets 2026-10-30 17:37:14 +08:00
jxxghp
d8fbabaa6a fix(apppush): preserve full notification text for web details 2026-10-30 16:52:58 +08:00
ranzhigg
6f11557eea fix: satisfy authorization PR checks 2026-10-30 16:26:44 +08:00
ranzhigg
914abf6273 fix: tighten API authorization boundaries 2026-10-30 16:14:49 +08:00
jxxghp
6ca7b294a0 fix(download): 共享站点流控并保留频控错误原因 (#7246) 
* fix(download): share site limits and preserve frequency errors

* test(startup): record shared site throttle module
 2026-10-30 14:53:32 +08:00
jxxghp
586a4f595e fix(transfer): settle tasks with missing metadata safely (#7245) 2026-10-30 14:34:07 +08:00
jxxghp
a9c992d9b9 fix(apppush): preserve posters in relay notifications (#7244) 2026-10-30 13:38:30 +08:00
jxxghp
9aab7c0f4c fix(agent): pin scheduled tasks to real execution accounts (#7241) 2026-10-29 22:39:08 +08:00
jxxghp
16cd9f75ed fix(apppush): deliver business notifications to all active users (#7235) 2026-10-29 21:43:18 +08:00
jxxghp
8a08847005 fix(transfer): handle replay jobs without parsed metadata (#7237) 
* fix(transfer): support replay jobs without parsed metadata

* refactor(transfer): remove obsolete metadata narrowing helper
 2026-10-29 17:34:22 +08:00
jxxghp
8fe8ea477e fix(agent): preserve cache keys for compatible Responses endpoints (#7236) 
Forward the stable anonymized session key through the generic OpenAI-compatible Responses path so gateways can retain cache routing across tool calls.

Refs #7233
 2026-10-29 17:17:48 +08:00
paysen
b55d9bd167 fix(transfer): recover legacy results and retain pending sources (#7232) 2026-10-29 17:06:36 +08:00
Tony Davis
421dd2c055 feat(llm): 新增 Obscurify.ai provider (#7229) 2026-10-29 17:06:11 +08:00
Cat
87561a90d1 fix(agent): route agent command receipts to the signed channel user (#7228) 
- Agent 代渠道用户调用内部 API 时，把会话渠道与渠道用户写入宿主签发令牌的签名
  声明（agent_channel、agent_channel_user），不再新增可伪造的请求头。
- /commands/run 对 Telegram 等通知渠道只使用与请求渠道一致的签名渠道用户执行命令
  和投递回执；缺少该声明时明确拒绝，不再把 MoviePilot 用户表主键当作渠道 chat id。
  Web、WebAgent 与无渠道调用仍按 MoviePilot 用户 ID 处理。
- 只读公共资料借用宿主身份，不携带渠道发起人声明。
- 同步依赖基线与架构总览中的内部导入边数量。

Refs #7225

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: jxxghp <jxxghp@gmail.com>
 2026-10-28 19:05:52 +08:00
Cat
252b702875 fix(site): keep redirect failures from aborting site requests (#7227) 2026-10-28 18:43:19 +08:00
jxxghp
be65e047b0 fix(plugin): support mirrors for Release asset downloads (#7224) 2026-10-27 22:21:48 +08:00
jxxghp
d9afaba8dd feat(plugin): expose documentation before installation (#7222) 2026-10-27 21:37:00 +08:00
JontyLee
6e405a67b3 fix(cache): Redis 故障日志遮盖缓存键中携带的请求凭据 (#7220) 2026-10-27 20:54:42 +08:00
jxxghp
2c0ea1d0c6 fix(display): 避免固定编号导致 Xvfb 启动冲突 (#7217) 
移除将 DISPLAY 追加到 Xvfb 命令的参数，交由显示后端分配空闲编号。补充真实命令构造、显示环境恢复和重复启停的回归测试。

Refs #7212
 2026-10-27 13:03:48 +08:00
kaestnerheisser207-web
bde74da51d fix(monitor): 避免下载临时文件触发未稳定告警 (#7215) 2026-10-27 12:41:49 +08:00
andyxu8023
e1b276bf9b fix(agent): encode API session header as ASCII (#7210) 2026-10-27 10:36:28 +08:00
jxxghp
222c0f0314 fix(ugreen): accept null poster wall lists 2026-10-27 07:31:05 +08:00
jxxghp
e9563b0346 perf(api): 合并卡片状态查询并减轻推荐轮询 (#7207) 2026-10-27 06:05:49 +08:00
Aqr-K
f84894faee fix(events): release handler ownership before notifying completion (#7206) 2026-10-27 05:43:57 +08:00
Aqr-K
b94b1c1496 fix(media): invalidate album cache when CUE content changes (#7203) 2026-10-27 05:42:40 +08:00
Aqr-K
71c2e9e3df fix(storage): retain history until target cleanup is confirmed (#7202) 2026-10-27 05:42:07 +08:00
jxxghp
42edfd1da8 fix(api): bound collection views and query calendar dates (#7200) 2026-10-27 00:40:09 +08:00
jxxghp
1bf496d0f3 fix(api): enforce token authentication for subscription list 
Refs #7198
 2026-10-26 23:19:31 +08:00
Derrors
72d940b835 fix(storage): detect nested 115 changes with stale directory times 
115 子项变化不保证推进祖先目录时间。禁用该存储的目录时间剪枝，沿用现有快照遍历、深度、分页及限流。补充 API 边界与真实轮询器回归，验证空基线、旧时间移入和重复派发。
 2026-10-26 21:59:07 +08:00
jxxghp
d73a880b75 Merge pull request #7196 from JontyLee/fix/trimemedia-access-code-log 
fix(trimemedia): 访问码校验失败日志不再记录设备访问码
 2026-10-26 21:24:11 +08:00
JontyLee
68d13fc5b2 fix(trimemedia): 访问码校验失败日志不再记录设备访问码 
verify_access_code 把设备访问码拼进校验地址的路径段（/c/<code>），一旦连不上
就把整条 URL 写进 error 日志，明文凭据随之落到实例日志文件里；404 与状态码两
个分支本来就不带访问码，这里补齐同一条边界：只记录设备根地址。

这是 #7157 之后对其余裸 {url} 日志点做完整评估时唯一确认会写入凭据的一处：其余
调用点记录的是站点根地址，或把 api_key 经 params 传递、URL 本身不含凭据。
 2026-10-26 20:49:21 +08:00
jxxghp
9fce7c4227 Merge pull request #7193 from JontyLee/fix/db-operation-secret-table-gate 2026-10-26 20:41:51 +08:00
JontyLee
0ba73f5b87 fix(database-operation): 拦截未显式授权的凭据配置表读取 
systemconfig 按 SystemConfigKey 聚合实例级 API Key、Cookie 与口令，托管
config.system.get 默认脱敏，但数据库技能脚本与 MCP database_operation 接受
任意 SQL，一条 SELECT 就能整包取回明文。

现在由脚本本身按表拦截：引用 systemconfig 的语句（含引号标识符、模式限定名、
CTE 与子查询）在读写两种模式下都默认拒绝，只有显式 --show-secrets /
show_secrets=true 才放行，失败信息直接给出可执行的下一步，因此 MCP 工具、
技能调用与命令行入口共享同一道边界。宿主策略把开启该开关的查询判定为
SENSITIVE_READ：要求系统管理员确认，结果标记为 SECRET，回执摘要不再保留内容。

门禁范围收敛为单表：userconfig 只承载界面偏好，plugindata 是文档化的诊断路径，
其余表的凭据残留风险改由 SKILL.md 的窄投影要求约束，避免以不可绕过的方式破坏
既有可运维性。MCP 文档、技能说明与相关契约测试同步更新。
 2026-10-26 20:20:16 +08:00
LIN student
de9fefe90f fix(torrent): refresh TTG path-signed download links 
- 将 TTG 的 /dl/{id}/{auth} 下载链接识别为短时签名链接，403 后复用既有的
  同资源刷新重试；仅匹配 totheglory.im 及其子域名，其他站点相同形态的路径不受影响。
- 从 TTG 详情页 /t/{id}/ 与下载路径 /dl/{id}/{auth} 提取稳定种子 ID，
  末段 auth 不参与资源身份，刷新时可匹配回同一种子。
- RSS 条目使用 rssdd.php?par= 链接，不受本次路径规则影响。

Refs #7191

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-26 19:13:52 +08:00
JontyLee
f2918b9285 fix(scheduler): 让声明为不限时的协程任务预算真正生效 
JobSpec.timeout_seconds 此前无法表达“显式不限时”：所有未声明预算的协程任务
一律补齐 SCHEDULER_JOB_TIMEOUT，订阅搜索队列因此被 3600 秒总时长判死，而它的
托管协程消费者无法靠取消收尾，只会把正常长轮次记成失败。现在收敛为三态语义
（正数为上限、0 为显式不限时、缺省继承默认），并修正 asyncio 超时异常 str()
为空导致的日志、系统通知与 SystemError 事件文本缺失。
 2026-10-26 10:34:42 +08:00
jxxghp
8f21e12d75 fix(search): release unused site request reservations 2026-10-26 09:23:29 +08:00
jxxghp
d696ffc994 Merge remote-tracking branch 'origin/v3' into codex/issue-7187 2026-10-26 09:14:32 +08:00
jxxghp
53f455cac8 fix(resources): normalize GitHub proxy and retry downloads 
Reuse the checked resource manifest within each download and retain phase-specific retry errors. Preserve application update error contracts.

Refs #7185
 2026-10-26 09:04:54 +08:00
jxxghp
251513f580 fix(search): honor the actual site rate limit when deferring 
Refs #7187
 2026-10-26 09:02:20 +08:00
jxxghp
046d4758e6 fix(search): persist processed candidates across queue resumes 
Refs #7183
 2026-10-26 08:50:04 +08:00
jxxghp
a799a93d52 Merge pull request #7186 from heydryft/feat/runcrate-llm-provider 
feat(llm): 新增 Runcrate provider
 2026-10-26 08:31:32 +08:00
jxxghp
2fb3890f9d fix(qbittorrent): 兼容 5.3 跳过校验参数 2026-10-25 18:30:00 +08:00