nas/MoviePilot
1
0
Fork 0
mirror of https://github.com/jxxghp/MoviePilot.git synced 2026-10-28 19:06:36 +08:00
Code Issues Packages Projects Releases Wiki Activity
10,670 Commits 3 Branches 376 Tags
v3
Commit Graph

2688 Commits

Author SHA1 Message Date
Cat
87561a90d1 fix(agent): route agent command receipts to the signed channel user (#7228) 
- Agent 代渠道用户调用内部 API 时，把会话渠道与渠道用户写入宿主签发令牌的签名
  声明（agent_channel、agent_channel_user），不再新增可伪造的请求头。
- /commands/run 对 Telegram 等通知渠道只使用与请求渠道一致的签名渠道用户执行命令
  和投递回执；缺少该声明时明确拒绝，不再把 MoviePilot 用户表主键当作渠道 chat id。
  Web、WebAgent 与无渠道调用仍按 MoviePilot 用户 ID 处理。
- 只读公共资料借用宿主身份，不携带渠道发起人声明。
- 同步依赖基线与架构总览中的内部导入边数量。

Refs #7225

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: jxxghp <jxxghp@gmail.com>
 2026-10-28 19:05:52 +08:00
Cat
252b702875 fix(site): keep redirect failures from aborting site requests (#7227) 2026-10-28 18:43:19 +08:00
jxxghp
be65e047b0 fix(plugin): support mirrors for Release asset downloads (#7224) 2026-10-27 22:21:48 +08:00
jxxghp
d9afaba8dd feat(plugin): expose documentation before installation (#7222) 2026-10-27 21:37:00 +08:00
JontyLee
6e405a67b3 fix(cache): Redis 故障日志遮盖缓存键中携带的请求凭据 (#7220) 2026-10-27 20:54:42 +08:00
jxxghp
2c0ea1d0c6 fix(display): 避免固定编号导致 Xvfb 启动冲突 (#7217) 
移除将 DISPLAY 追加到 Xvfb 命令的参数，交由显示后端分配空闲编号。补充真实命令构造、显示环境恢复和重复启停的回归测试。

Refs #7212
 2026-10-27 13:03:48 +08:00
kaestnerheisser207-web
bde74da51d fix(monitor): 避免下载临时文件触发未稳定告警 (#7215) 2026-10-27 12:41:49 +08:00
andyxu8023
e1b276bf9b fix(agent): encode API session header as ASCII (#7210) 2026-10-27 10:36:28 +08:00
jxxghp
222c0f0314 fix(ugreen): accept null poster wall lists 2026-10-27 07:31:05 +08:00
jxxghp
e9563b0346 perf(api): 合并卡片状态查询并减轻推荐轮询 (#7207) 2026-10-27 06:05:49 +08:00
Aqr-K
f84894faee fix(events): release handler ownership before notifying completion (#7206) 2026-10-27 05:43:57 +08:00
Aqr-K
8b2275592e fix(database): enforce SQLite secret-table access during execution (#7205) 2026-10-27 05:43:37 +08:00
Aqr-K
ae4833e261 fix(publish): pin plugin reads and writes to one commit (#7204) 2026-10-27 05:43:16 +08:00
Aqr-K
b94b1c1496 fix(media): invalidate album cache when CUE content changes (#7203) 2026-10-27 05:42:40 +08:00
Aqr-K
71c2e9e3df fix(storage): retain history until target cleanup is confirmed (#7202) 2026-10-27 05:42:07 +08:00
jxxghp
42edfd1da8 fix(api): bound collection views and query calendar dates (#7200) 2026-10-27 00:40:09 +08:00
jxxghp
1bf496d0f3 fix(api): enforce token authentication for subscription list 
Refs #7198
 2026-10-26 23:19:31 +08:00
Derrors
72d940b835 fix(storage): detect nested 115 changes with stale directory times 
115 子项变化不保证推进祖先目录时间。禁用该存储的目录时间剪枝，沿用现有快照遍历、深度、分页及限流。补充 API 边界与真实轮询器回归，验证空基线、旧时间移入和重复派发。
 2026-10-26 21:59:07 +08:00
jxxghp
d73a880b75 Merge pull request #7196 from JontyLee/fix/trimemedia-access-code-log 
fix(trimemedia): 访问码校验失败日志不再记录设备访问码
 2026-10-26 21:24:11 +08:00
JontyLee
68d13fc5b2 fix(trimemedia): 访问码校验失败日志不再记录设备访问码 
verify_access_code 把设备访问码拼进校验地址的路径段（/c/<code>），一旦连不上
就把整条 URL 写进 error 日志，明文凭据随之落到实例日志文件里；404 与状态码两
个分支本来就不带访问码，这里补齐同一条边界：只记录设备根地址。

这是 #7157 之后对其余裸 {url} 日志点做完整评估时唯一确认会写入凭据的一处：其余
调用点记录的是站点根地址，或把 api_key 经 params 传递、URL 本身不含凭据。
 2026-10-26 20:49:21 +08:00
jxxghp
9fce7c4227 Merge pull request #7193 from JontyLee/fix/db-operation-secret-table-gate 2026-10-26 20:41:51 +08:00
JontyLee
0ba73f5b87 fix(database-operation): 拦截未显式授权的凭据配置表读取 
systemconfig 按 SystemConfigKey 聚合实例级 API Key、Cookie 与口令，托管
config.system.get 默认脱敏，但数据库技能脚本与 MCP database_operation 接受
任意 SQL，一条 SELECT 就能整包取回明文。

现在由脚本本身按表拦截：引用 systemconfig 的语句（含引号标识符、模式限定名、
CTE 与子查询）在读写两种模式下都默认拒绝，只有显式 --show-secrets /
show_secrets=true 才放行，失败信息直接给出可执行的下一步，因此 MCP 工具、
技能调用与命令行入口共享同一道边界。宿主策略把开启该开关的查询判定为
SENSITIVE_READ：要求系统管理员确认，结果标记为 SECRET，回执摘要不再保留内容。

门禁范围收敛为单表：userconfig 只承载界面偏好，plugindata 是文档化的诊断路径，
其余表的凭据残留风险改由 SKILL.md 的窄投影要求约束，避免以不可绕过的方式破坏
既有可运维性。MCP 文档、技能说明与相关契约测试同步更新。
 2026-10-26 20:20:16 +08:00
LIN student
de9fefe90f fix(torrent): refresh TTG path-signed download links 
- 将 TTG 的 /dl/{id}/{auth} 下载链接识别为短时签名链接，403 后复用既有的
  同资源刷新重试；仅匹配 totheglory.im 及其子域名，其他站点相同形态的路径不受影响。
- 从 TTG 详情页 /t/{id}/ 与下载路径 /dl/{id}/{auth} 提取稳定种子 ID，
  末段 auth 不参与资源身份，刷新时可匹配回同一种子。
- RSS 条目使用 rssdd.php?par= 链接，不受本次路径规则影响。

Refs #7191

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-26 19:13:52 +08:00
jxxghp
a11bc444f4 fix(ci): audit patched free-threaded brotli 2026-10-26 17:12:22 +08:00
JontyLee
f2918b9285 fix(scheduler): 让声明为不限时的协程任务预算真正生效 
JobSpec.timeout_seconds 此前无法表达“显式不限时”：所有未声明预算的协程任务
一律补齐 SCHEDULER_JOB_TIMEOUT，订阅搜索队列因此被 3600 秒总时长判死，而它的
托管协程消费者无法靠取消收尾，只会把正常长轮次记成失败。现在收敛为三态语义
（正数为上限、0 为显式不限时、缺省继承默认），并修正 asyncio 超时异常 str()
为空导致的日志、系统通知与 SystemError 事件文本缺失。
 2026-10-26 10:34:42 +08:00
jxxghp
8f21e12d75 fix(search): release unused site request reservations 2026-10-26 09:23:29 +08:00
jxxghp
d696ffc994 Merge remote-tracking branch 'origin/v3' into codex/issue-7187 2026-10-26 09:14:32 +08:00
jxxghp
109a6d2834 test(search): cover disabled local rate limit rules 2026-10-26 09:11:45 +08:00
jxxghp
53f455cac8 fix(resources): normalize GitHub proxy and retry downloads 
Reuse the checked resource manifest within each download and retain phase-specific retry errors. Preserve application update error contracts.

Refs #7185
 2026-10-26 09:04:54 +08:00
jxxghp
251513f580 fix(search): honor the actual site rate limit when deferring 
Refs #7187
 2026-10-26 09:02:20 +08:00
jxxghp
046d4758e6 fix(search): persist processed candidates across queue resumes 
Refs #7183
 2026-10-26 08:50:04 +08:00
jxxghp
a799a93d52 Merge pull request #7186 from heydryft/feat/runcrate-llm-provider 
feat(llm): 新增 Runcrate provider
 2026-10-26 08:31:32 +08:00
jxxghp
2fb3890f9d fix(qbittorrent): 兼容 5.3 跳过校验参数 2026-10-25 18:30:00 +08:00
Nirupam Bhowmick
363b8d9e5d feat(llm): 新增 Runcrate provider 
新增 Runcrate OpenAI-compatible 预设（https://api.runcrate.ai/v1），沿用共享
openai_compatible 通道，模型目录通过 /v1/models 发现；附带模型发现的边界回归测试。

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-25 08:02:17 +00:00
jxxghp
d66b58c475 feat(widget): enrich system and combined media summaries 2026-10-25 14:53:54 +08:00
jxxghp
d5ecf2927c feat(widget): 显示下载上传速度和剩余磁盘空间 (#7177) 2026-10-25 11:28:36 +08:00
jxxghp
86ededa739 feat(widget): 增加当前主登录的只读账号上下文 (#7176) 2026-10-25 06:28:57 +08:00
jxxghp
721c03734a feat(widget): 提供受限凭据和只读快照接口 (#7175) 
* feat(widget): add restricted read-only snapshot foundation

* test(widget): 补齐运行时与文档迁移契约
 2026-10-25 06:02:47 +08:00
DDSRem
21af7a0170 fix(metainfo): exclude resolution tags from anime detection (#7173) 
* chore: bump moviepilot-rust to 0.3.12

* fix(metainfo): exclude resolution tags from anime detection

保留年份并排除分辨率标签触发的伪季集，补充 Python 与 Rust 的标题和路径回归。补齐 0.3.12 wheel 锁，并定向修复 Brotli 与 setuptools 的依赖审计阻断。

---------

Co-authored-by: jxxghp <51039935+jxxghp@users.noreply.github.com>
Co-authored-by: jxxghp <jxxghp@gmail.com>
 2026-10-24 21:01:23 +08:00
jxxghp
81260dc452 fix(notification): persist independent media posters 2026-10-24 19:11:27 +08:00
jxxghp
6680e090e6 feat: 自动登记中心推送实例并安全轮换凭据 2026-10-24 09:17:24 +08:00
jxxghp
fc01a149ca test: cover AppPush device management relay boundaries 2026-10-24 08:16:05 +08:00
jxxghp
438fa5ef0a test: synchronize AppPush inventory and architecture metrics 2026-10-24 07:57:17 +08:00
jxxghp
3ac7526930 feat(notification): relay AppPush through private MoviePilot Server 2026-10-24 07:32:00 +08:00
zkmydgth
d62e9ba579 [功能] publish-moviepilot-plugin 技能改为单提交推送 (#7168) 2026-10-24 06:58:30 +08:00
jxxghp
d8cb95ab9e fix(filter): 修复分类名称与目录不一致时跳过规则组 (#7165) 
* fix(filter): match rule groups to effective media categories

* docs(architecture): sync dependency count for category matching
 2026-10-23 23:15:28 +08:00
jxxghp
b51f93f60f fix(subscribe): reconcile inferred media type conflicts (#7166) 2026-10-23 23:08:10 +08:00
zkmydgth
228bbf59d3 [功能] publish-moviepilot-plugin 技能支持 V3 插件仓库布局 (#7163) 2026-10-23 22:48:35 +08:00
jxxghp
e1b0d5b4bf fix(indexer): identify HDDolby API connection failures (#7164) 2026-10-23 21:04:49 +08:00
jxxghp
cc3845621f fix(db): invalidate SQLite connections after I/O errors (#7161) 2026-10-23 19:42:31 +08:00