Fixed (licensing): the license key field is always visible, so a new key can be activated even while the saved license still shows as active; a refused key no longer replaces the saved key and the page shows why; when the last check fails (for example a deleted or revoked license), the page and the log show a warning with the date until which the saved license keeps working; activation, manual checks and release are written to the log.
Changelog von Security Notifications
Jede veröffentlichte Version, die neueste zuerst. Downloads findest du in deinem Konto; Abonnements und Tests bekommen immer die neueste Version, Lifetime-Lizenzen bekommen Updates innerhalb ihres Update-Zeitraums.
0.1.4
Erfordert Emby Server 4.10.1.0+- Security: account names, device and app names, the geo organization and request paths (text anyone can send, without an account) are cleaned before they reach alerts: the HTML characters < > " ' & become look-alike characters, control and invisible characters are removed, and the length is capped. A failed sign-in with a name like
x<img src=x onerror=…>can no longer run code in the admin page when you open the alert from Dashboard → Activity. This applies to every channel (activity log, Telegram, e-mail, webhook). - Security: reading the Emby request log can no longer be fooled. Lines are only recognized from the start (date, level, logger name), the address is taken only from the response line, and the connection id must be close to the id of the plugin's own probe request, so a User-Agent or a URL with %0A can no longer invent "Exploit attempt from " alerts.
- No flooding: at most 20 notifications per 10 minutes; the rest stay in the history and a single "N more alerts suppressed" message is sent. Critical alerts always go through. The memory used for tracked IP addresses and accounts is capped.
- Webhook: the address is checked after DNS resolution; local, private and internal addresses (including 169.254.169.254) are refused, redirects are not followed, and the error no longer includes the response body. For your own ntfy/Gotify on the local network, tick the new option "Allow a local network address" (link-local and metadata addresses stay refused).
- E-mail: the subject is always a single line (no CR/LF).
- Secrets (Telegram token, SMTP password, webhook address, MaxMind key) are stored encrypted (AES-256-GCM, bound to your server) in the shared MediaLab store; the old secrets.json file is moved automatically and deleted.
- Security (licensing): logs sent to medialab.works or exported no longer contain tokens, passwords or keys (lines are selected by the plugin's logger and secrets are masked); unencrypted license server answers are refused; update and rollback only install packages with a verified MediaLab signature (and a size limit); the log export no longer puts the token in the URL; the pages escape text in attributes correctly.
0.1.3
Erfordert Emby Server 4.10.1.0+- Privacy: the payment QR code on the License page is now generated locally, in the page; the payment link is no longer sent to a third-party QR service (api.qrserver.com).
0.1.2
Erfordert Emby Server 4.10.1.0+- Fixed: sending alerts on every channel (Telegram, Discord, Slack, Gotify, webhook) failed in the published build with a serialization error. The cause was the obfuscation (anonymous types serialized with System.Text.Json); builds are now checked automatically on every release.
0.1.1
Erfordert Emby Server 4.10.1.0+- Plugin author shown as MediaLab Works. No functional change.
0.1.0
Erfordert Emby Server 4.10.1.0+- First release: 20 security rules (attacks on accounts, unusual sign-ins, sensitive changes, mass deletions, scans, spoofed proxy headers, backdoors in the plugins folder, known vulnerabilities of your server version); notifications via Telegram, email, webhook (Discord, Slack, ntfy, Gotify, JSON) and the activity log; no spam (de-duplication, grouping, quiet hours, daily digest); location from DB-IP Lite or MaxMind GeoLite2; history with CSV export. Update and rollback from the License page, with the license checked first.