splitsec2 61c7ad3c62 Merge commit from fork ...

* fix(torrent): check each redirect hop when fetching a torrent file

The torrent file fetch followed redirects by hand without looking at where a
hop pointed, so a download link could make the server request a loopback,
link-local or LAN address. Each hop (the initial URL and every redirect
Location) must now be http or https and resolve only to global addresses.
The configured Prowlarr/Newznab origin is exempt, as it usually lives on the
LAN. The API key still only goes to that origin.

* fix(socketio): only accept websocket handshakes from the app's own origin

The Socket.IO server allowed every origin. It now uses the same-origin check
python-engineio applies by default (Host, or X-Forwarded-Proto and
X-Forwarded-Host behind a proxy). SOCKETIO_ALLOWED_ORIGINS takes a comma
separated list of extra origins for proxies that change Host without
forwarding it.

* fix(custom-script): do not pass a file name that starts with a dash as the first argument

In relative path mode the script got the organized file's relative path as
its first argument, which many scripts read as an option when the name starts
with a dash. Such a name is now passed with a ./ prefix. Absolute mode is
unchanged.

2026-10-21 01:34:38 -04:00

..

bypasser_permission_lab.sh

Updated permissions model and non-root support (#871)

2026-04-12 08:22:32 +01:00

generate_env_docs.py

Merge commit from fork

2026-10-21 01:34:38 -04:00

test_clients.py

feat(slskd): add Soulseek (slskd) release source, building on #1335 (#1428)

2026-10-20 01:33:12 -04:00