Fixed (licensing): the license key field is always visible, so a new key can be activated even while the saved license still shows as active; a refused key no longer replaces the saved key and the page shows why; when the last check fails (for example a deleted or revoked license), the page and the log show a warning with the date until which the saved license keeps working; activation, manual checks and release are written to the log.
Changelog von Security Notifications
Jede veröffentlichte Version, die neueste zuerst. Die Builds unserer Jellyfin-Plugins und ihr vollständiger Quellcode sind öffentlich (GPL-3.0); zum Ausführen braucht das Plugin eine Lizenz. Abonnements und Tests bekommen immer die neueste Version, Lifetime-Lizenzen bekommen Updates innerhalb ihres Update-Zeitraums.
0.1.4
Neueste- Security: account names, device and app names, the geo organization and request paths (text anyone can send, without an account) are cleaned before they reach alerts: the HTML characters < > " ' & become look-alike characters, control and invisible characters are removed, and the length is capped. A failed sign-in with a name like
x<img src=x onerror=…>reaches the alerts as plain text (the Jellyfin dashboard already shows the text safely; the cleaning also protects the other channels). This applies to every channel (activity log, Telegram, e-mail, webhook). - No flooding: at most 20 notifications per 10 minutes; the rest stay in the history and a single "N more alerts suppressed" message is sent. Critical alerts always go through. The memory used for tracked IP addresses and accounts is capped.
- Webhook: the address is checked after DNS resolution; local, private and internal addresses (including 169.254.169.254) are refused, redirects are not followed, and the error no longer includes the response body. For your own ntfy/Gotify on the local network, tick the new option "Allow a local network address" (link-local and metadata addresses stay refused).
- E-mail: the subject is always a single line (no CR/LF).
- Secrets (Telegram token, SMTP password, webhook address, MaxMind key) are stored encrypted (AES-256-GCM, bound to your server) in the shared MediaLab store; the old secrets.json file is moved automatically and deleted.
- Security (licensing): logs sent to medialab.works or exported no longer contain tokens, passwords or keys (lines are selected by the plugin's logger and secrets are masked); unencrypted license server answers are refused; update and rollback only install packages with a verified MediaLab signature (and a size limit); the log export no longer puts the token in the URL; the pages escape text in attributes correctly.
- Plugin name in Jellyfin: "Security Notifications by MediaLab". Author: MediaLab Works.
- First release: 20 security rules (attacks on accounts, unusual sign-ins, sensitive changes, mass deletions, scans, spoofed proxy headers, backdoors in the plugins folder, known vulnerabilities of your server version); notifications via Telegram, email, webhook (Discord, Slack, ntfy, Gotify, JSON) and the activity log; no spam (de-duplication, grouping, quiet hours, daily digest); location from DB-IP Lite or MaxMind GeoLite2; history with CSV export. Update and rollback from the License page, with the license checked first.