Fixed (licensing): the license key field is always visible, so a new key can be activated even while the saved license still shows as active; a refused key no longer replaces the saved key and the page shows why; when the last check fails (for example a deleted or revoked license), the page and the log show a warning with the date until which the saved license keeps working; activation, manual checks and release are written to the log.
Changelog von Cashier
Jede veröffentlichte Version, die neueste zuerst. Die Builds unserer Jellyfin-Plugins und ihr vollständiger Quellcode sind öffentlich (GPL-3.0); zum Ausführen braucht das Plugin eine Lizenz. Abonnements und Tests bekommen immer die neueste Version, Lifetime-Lizenzen bekommen Updates innerhalb ihres Update-Zeitraums.
0.1.6
Neueste- Security (licensing): logs sent to medialab.works or exported no longer contain tokens, passwords or keys; unencrypted license-server replies are refused; update and rollback install only packages with a verified MediaLab signature; the License page escapes text in attributes correctly.
- Security: the admin panel and the payment page also escape quotes (a username can no longer break out of an HTML attribute), and invoice links open only if they are https://.
- Security: the TV's Quick Connect code is kept only for an opened Stripe payment, bound to that session, and approved once, when exactly that payment is confirmed (it expires after 10 minutes). A payment link of an already active account can no longer sign in a foreign TV.
- An existing account that is not a subscriber (family, older accounts) and only opens the checkout no longer comes under Cashier (before, it was suspended at the next check). The account becomes a subscriber only once Stripe confirms a subscription.
- Payment links can be revoked: a new button on each subscriber ("revoke payment links") and "Revoke all payment links" on the Stripe tab (new key). After a payment, old links no longer open the checkout or the portal (they only show the account status for a few hours). The Stripe portal opens through a link received in the last 24 hours or while signed in to Jellyfin. Links from earlier versions keep working until they expire or until the first revocation/payment.
- "Send me the link": the answer comes at once and is the same for any name (the e-mail is sent in the background); at most one e-mail per 15 minutes and 5 per day for the same subscriber. Per-IP limits no longer grow without bound in memory.
- A checkout opened earlier by the same account (another tab or device) is closed in Stripe when a new one opens, so two subscriptions cannot both be paid; if a second live subscription still appears, the admin is notified.
- Panel: a wrong Stripe key (e.g. pk_) is refused before saving and no longer replaces the working key.
- Note: on Jellyfin the device limit applies at sign-in (MaxActiveSessions); several players sharing one session are not counted separately (a platform limit).
- Right after a Jellyfin restart, the link with Registration is made within 1–2 seconds (before: after 20 seconds, then once a minute). A new account created in the first minute after a restart is now sent to payment like any other.
0.1.2
Ersetzt, nicht verteiltNur der Vollständigkeit halber aufgeführt: weder zum Download noch als Update verfügbar.
- Third-party licenses (MIT) included in the package; plugin name "Cashier by MediaLab". Replaced by 0.1.3, which also fixes the restart issue.
- License page: trial and purchase now use the Jellyfin products (
jf-bundle,jf-<plugin>) instead of the Emby ones; this is also corrected on the server side for older pages. - After a rollback, Jellyfin's "Update Plugins" task no longer reinstalls the newer version: automatic updates are turned off for the rolled-back version and turned on again with the next "Install update". The state is shown on the License page.
First release for Jellyfin 12.2 or newer (GPL-3.0, source code included).