nas/MoviePilot
1
0
Fork 0
mirror of https://github.com/jxxghp/MoviePilot.git synced 2026-11-15 12:50:20 +08:00
Code Issues Packages Projects Releases Wiki Activity
10,683 Commits 11 Branches 381 Tags
80a76dee5656d5ce12dbbf249c390ec0633219a3
Commit Graph

10683 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
ranzhigg
80a76dee56 fix(storage): bind management operations to verified targets 2026-10-30 17:37:14 +08:00
ranzhigg
f538c7276b style: sort authorization test imports 2026-10-30 16:33:03 +08:00
ranzhigg
6f11557eea fix: satisfy authorization PR checks 2026-10-30 16:26:44 +08:00
ranzhigg
914abf6273 fix: tighten API authorization boundaries 2026-10-30 16:14:49 +08:00
jxxghp
9aab7c0f4c fix(agent): pin scheduled tasks to real execution accounts (#7241) 2026-10-29 22:39:08 +08:00
jxxghp
16cd9f75ed fix(apppush): deliver business notifications to all active users (#7235) 2026-10-29 21:43:18 +08:00
jxxghp
4f91c6be75 test(apppush): verify persisted channels survive restart 2026-10-29 19:15:38 +08:00
jxxghp
edc9c77827 fix(deps): update langgraph for CVE-2026-118667 2026-10-29 17:52:48 +08:00
jxxghp
73399938a0 chore(release): publish v3.2.2 with frontend v3.2.2 2026-10-29 17:41:50 +08:00
jxxghp
8a08847005 fix(transfer): handle replay jobs without parsed metadata (#7237) 
* fix(transfer): support replay jobs without parsed metadata

* refactor(transfer): remove obsolete metadata narrowing helper
 2026-10-29 17:34:22 +08:00
jxxghp
8fe8ea477e fix(agent): preserve cache keys for compatible Responses endpoints (#7236) 
Forward the stable anonymized session key through the generic OpenAI-compatible Responses path so gateways can retain cache routing across tool calls.

Refs #7233
 2026-10-29 17:17:48 +08:00
paysen
b55d9bd167 fix(transfer): recover legacy results and retain pending sources (#7232) 2026-10-29 17:06:36 +08:00
Tony Davis
421dd2c055 feat(llm): 新增 Obscurify.ai provider (#7229) 2026-10-29 17:06:11 +08:00
Cat
87561a90d1 fix(agent): route agent command receipts to the signed channel user (#7228) 
- Agent 代渠道用户调用内部 API 时，把会话渠道与渠道用户写入宿主签发令牌的签名
  声明（agent_channel、agent_channel_user），不再新增可伪造的请求头。
- /commands/run 对 Telegram 等通知渠道只使用与请求渠道一致的签名渠道用户执行命令
  和投递回执；缺少该声明时明确拒绝，不再把 MoviePilot 用户表主键当作渠道 chat id。
  Web、WebAgent 与无渠道调用仍按 MoviePilot 用户 ID 处理。
- 只读公共资料借用宿主身份，不携带渠道发起人声明。
- 同步依赖基线与架构总览中的内部导入边数量。

Refs #7225

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: jxxghp <jxxghp@gmail.com>
 2026-10-28 19:05:52 +08:00
Cat
252b702875 fix(site): keep redirect failures from aborting site requests (#7227) 2026-10-28 18:43:19 +08:00
jxxghp
be65e047b0 fix(plugin): support mirrors for Release asset downloads (#7224) 2026-10-27 22:21:48 +08:00
jxxghp
d9afaba8dd feat(plugin): expose documentation before installation (#7222) 2026-10-27 21:37:00 +08:00
JontyLee
6e405a67b3 fix(cache): Redis 故障日志遮盖缓存键中携带的请求凭据 (#7220) 2026-10-27 20:54:42 +08:00
jxxghp
2c0ea1d0c6 fix(display): 避免固定编号导致 Xvfb 启动冲突 (#7217) 
移除将 DISPLAY 追加到 Xvfb 命令的参数，交由显示后端分配空闲编号。补充真实命令构造、显示环境恢复和重复启停的回归测试。

Refs #7212
 2026-10-27 13:03:48 +08:00
kaestnerheisser207-web
bde74da51d fix(monitor): 避免下载临时文件触发未稳定告警 (#7215) 2026-10-27 12:41:49 +08:00
andyxu8023
e1b276bf9b fix(agent): encode API session header as ASCII (#7210) 2026-10-27 10:36:28 +08:00
jxxghp
222c0f0314 fix(ugreen): accept null poster wall lists 2026-10-27 07:31:05 +08:00
jxxghp
c30b861a3c chore(release): publish v3.2.1 with frontend v3.2.1 2026-10-27 06:17:32 +08:00
jxxghp
e9563b0346 perf(api): 合并卡片状态查询并减轻推荐轮询 (#7207) 2026-10-27 06:05:49 +08:00
Aqr-K
f84894faee fix(events): release handler ownership before notifying completion (#7206) 2026-10-27 05:43:57 +08:00
Aqr-K
8b2275592e fix(database): enforce SQLite secret-table access during execution (#7205) 2026-10-27 05:43:37 +08:00
Aqr-K
ae4833e261 fix(publish): pin plugin reads and writes to one commit (#7204) 2026-10-27 05:43:16 +08:00
Aqr-K
b94b1c1496 fix(media): invalidate album cache when CUE content changes (#7203) 2026-10-27 05:42:40 +08:00
Aqr-K
71c2e9e3df fix(storage): retain history until target cleanup is confirmed (#7202) 2026-10-27 05:42:07 +08:00
jxxghp
42edfd1da8 fix(api): bound collection views and query calendar dates (#7200) 2026-10-27 00:40:09 +08:00
jxxghp
1bf496d0f3 fix(api): enforce token authentication for subscription list 
Refs #7198
 2026-10-26 23:19:31 +08:00
jxxghp
f4fbc6cad8 Merge pull request #7197 from Derrors/fix/u115-snapshot-recursive-20261026 2026-10-26 22:14:54 +08:00
Derrors
72d940b835 fix(storage): detect nested 115 changes with stale directory times 
115 子项变化不保证推进祖先目录时间。禁用该存储的目录时间剪枝，沿用现有快照遍历、深度、分页及限流。补充 API 边界与真实轮询器回归，验证空基线、旧时间移入和重复派发。
 2026-10-26 21:59:07 +08:00
jxxghp
d73a880b75 Merge pull request #7196 from JontyLee/fix/trimemedia-access-code-log 
fix(trimemedia): 访问码校验失败日志不再记录设备访问码
 2026-10-26 21:24:11 +08:00
JontyLee
68d13fc5b2 fix(trimemedia): 访问码校验失败日志不再记录设备访问码 
verify_access_code 把设备访问码拼进校验地址的路径段（/c/<code>），一旦连不上
就把整条 URL 写进 error 日志，明文凭据随之落到实例日志文件里；404 与状态码两
个分支本来就不带访问码，这里补齐同一条边界：只记录设备根地址。

这是 #7157 之后对其余裸 {url} 日志点做完整评估时唯一确认会写入凭据的一处：其余
调用点记录的是站点根地址，或把 api_key 经 params 传递、URL 本身不含凭据。
 2026-10-26 20:49:21 +08:00
jxxghp
9fce7c4227 Merge pull request #7193 from JontyLee/fix/db-operation-secret-table-gate 2026-10-26 20:41:51 +08:00
jxxghp
86e0d8ac4b Merge pull request #7192 from MiCat-S/fix/ttg-path-signed-torrent-refresh 2026-10-26 20:41:08 +08:00
JontyLee
0ba73f5b87 fix(database-operation): 拦截未显式授权的凭据配置表读取 
systemconfig 按 SystemConfigKey 聚合实例级 API Key、Cookie 与口令，托管
config.system.get 默认脱敏，但数据库技能脚本与 MCP database_operation 接受
任意 SQL，一条 SELECT 就能整包取回明文。

现在由脚本本身按表拦截：引用 systemconfig 的语句（含引号标识符、模式限定名、
CTE 与子查询）在读写两种模式下都默认拒绝，只有显式 --show-secrets /
show_secrets=true 才放行，失败信息直接给出可执行的下一步，因此 MCP 工具、
技能调用与命令行入口共享同一道边界。宿主策略把开启该开关的查询判定为
SENSITIVE_READ：要求系统管理员确认，结果标记为 SECRET，回执摘要不再保留内容。

门禁范围收敛为单表：userconfig 只承载界面偏好，plugindata 是文档化的诊断路径，
其余表的凭据残留风险改由 SKILL.md 的窄投影要求约束，避免以不可绕过的方式破坏
既有可运维性。MCP 文档、技能说明与相关契约测试同步更新。
 2026-10-26 20:20:16 +08:00
LIN student
de9fefe90f fix(torrent): refresh TTG path-signed download links 
- 将 TTG 的 /dl/{id}/{auth} 下载链接识别为短时签名链接，403 后复用既有的
  同资源刷新重试；仅匹配 totheglory.im 及其子域名，其他站点相同形态的路径不受影响。
- 从 TTG 详情页 /t/{id}/ 与下载路径 /dl/{id}/{auth} 提取稳定种子 ID，
  末段 auth 不参与资源身份，刷新时可匹配回同一种子。
- RSS 条目使用 rssdd.php?par= 链接，不受本次路径规则影响。

Refs #7191

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-26 19:13:52 +08:00
jxxghp
a11bc444f4 fix(ci): audit patched free-threaded brotli 2026-10-26 17:12:22 +08:00
jxxghp
03b069c62f chore(release): publish v3.2.0 2026-10-26 16:45:11 +08:00
jxxghp
dc632c2cf3 Merge pull request #7190 from JontyLee/fix/scheduler-job-timeout-budget 
fix(scheduler): 让声明为不限时的协程任务预算真正生效
 2026-10-26 15:06:24 +08:00
JontyLee
f2918b9285 fix(scheduler): 让声明为不限时的协程任务预算真正生效 
JobSpec.timeout_seconds 此前无法表达“显式不限时”：所有未声明预算的协程任务
一律补齐 SCHEDULER_JOB_TIMEOUT，订阅搜索队列因此被 3600 秒总时长判死，而它的
托管协程消费者无法靠取消收尾，只会把正常长轮次记成失败。现在收敛为三态语义
（正数为上限、0 为显式不限时、缺省继承默认），并修正 asyncio 超时异常 str()
为空导致的日志、系统通知与 SystemError 事件文本缺失。
 2026-10-26 10:34:42 +08:00
jxxghp
291552b4a2 Merge pull request #7189 from jxxghp/codex/issue-7187 
fix(search): 按实际流控原因计算站点剩余等待时间
 2026-10-26 09:40:36 +08:00
jxxghp
8f21e12d75 fix(search): release unused site request reservations 2026-10-26 09:23:29 +08:00
jxxghp
d696ffc994 Merge remote-tracking branch 'origin/v3' into codex/issue-7187 2026-10-26 09:14:32 +08:00
jxxghp
109a6d2834 test(search): cover disabled local rate limit rules 2026-10-26 09:11:45 +08:00
jxxghp
53f455cac8 fix(resources): normalize GitHub proxy and retry downloads 
Reuse the checked resource manifest within each download and retain phase-specific retry errors. Preserve application update error contracts.

Refs #7185
 2026-10-26 09:04:54 +08:00
jxxghp
251513f580 fix(search): honor the actual site rate limit when deferring 
Refs #7187
 2026-10-26 09:02:20 +08:00
jxxghp
232c9755e5 Merge pull request #7188 from jxxghp/codex/issue-7183 
fix(search): 修复订阅搜索恢复后候选重复抢占站点预算
 2026-10-26 08:57:42 +08:00