Changelog von MediaLab TV

Fixed (licensing): the license key field is always visible, so a new key can be activated even while the saved license still shows as active; a refused key no longer replaces the saved key and the page shows why; when the last check fails (for example a deleted or revoked license), the page and the log show a warning with the date until which the saved license keeps working; activation, manual checks and release are written to the log.

TV-6: genre/person names in the title list are no longer fetched by id directly (on Emby without the library check, on Jellyfin without userId) — they go through the access-checked path. Hardening L1a: all e2e suites pass (browse 74/74 on both platforms, launcher, tv-e2e, Turnstile security). Modernizations: the access-path auto-patch is cancelled on server shutdown, the request abort token reaches the license checks, swallowed exceptions reach the log, css/js cached for 1 h.

• OSD rebuilt for TV remotes: progress bar with watched vs total, cursor, chapter marks, elapsed/total time, media badges and clean buttons.
• Chapters: press Down twice for a horizontal strip with thumbnails, title and time; OK jumps to the chapter. No scrollbars in the OSD (subtitle/audio panel and chapters scroll with focus); modern white focus.
• Includes the Turnstile security fix from 1.3.2.

• Security update: plugin installation now requires the package checksum and signature and rejects unsafe file names; the SpeedTest limit is per user with a concurrency cap; the movie quota is spent only on a successful add and "undo" reports errors; TV Turnstile login requires the exact page action.

Includes everything from 1.3.0 (not published separately):

• Player rebuilt for TV remotes: Fullscreen button, quick subtitle and audio pickers, live channel list with the current programme, chapters with marks on the seek bar, volume on media keys, OSD lock, media info badges.
• Permanent AUTO quality based on the real network speed (starts from a measurement, then adapts up / down).
• New "Check network" screen in the menu.
• Resume now starts correctly from the saved position.

• Security (audit, TV-1): profiles saved on the TV no longer keep the access token of other accounts, only the name and the image. Switching to another profile asks for that account's password (or the Emby profile PIN, for an account without a password); the previous profile's token is revoked on the server when switching. Tokens saved by earlier versions are revoked on the first start.
• Security (TV-2): an SVG logo uploaded by the administrator is parsed as XML (no DTD) and rewritten from allowed elements and attributes only; external addresses, animations, <use>, <image> and <style> are removed, and an SVG with a script is refused. Logos uploaded earlier go through the same filter. The logo is served with Content-Disposition: inline and the CSP sandbox policy.
• Security (TV-3): the "Remember the password on TVs" option stays off by default, applies only in TV browsers (never on computers or phones), and the admin page warns that the password is kept unencrypted on the TV.
• Security (TV-4): the access-path redirect is recognised as the plugin's own only by its exact header or the exact 1.0 content, not by a mere mention of the address; a foreign page can no longer be overwritten or deleted (also in tools/install-redirect.sh).
• New: Cloudflare Turnstile anti-bot check on the TV sign-in page (off by default). Settings: on/off, site key, secret key (kept encrypted on the server) or "Use the Registration keys". When active, the page signs in through /emby/MediaLabTv/Login, which verifies the token with Cloudflare (with the real client IP), limits attempts per IP and then uses the server's normal sign-in (with the lockout after wrong passwords). The widget is invisible; a box appears only when Cloudflare asks for a confirmation, and the remote's arrow keys reach it. The server's own /Users/AuthenticateByName stays reachable: Turnstile is anti-bot friction for this page, not a server-wide gate.
• New: "Trusted proxies" and "The server is behind Cloudflare" settings: the client address for the limit and Turnstile is taken from X-Forwarded-For / CF-Connecting-IP only from these addresses (by default only from the server itself).
• New account from the phone (with Registration 1.10.8+): at the end the TV receives a session created by the server, not the account password, and signs in with it by itself.
• Licensing: unsealed responses from the license server are refused, release descriptors (update, rollback) must be signed, exported logs are redacted.

• Privacy: the payment QR code on the License page is now generated locally, in the page; the payment link is no longer sent to a third-party QR service (api.qrserver.com).
• Full screen: a header button (only when the browser supports it) and the F key; when coming from Quick Connect or on a TV, the first OK / click switches to full screen (browsers require a user gesture).

Includes everything in 1.2.0:

• New Netflix-style interface, opened by default after sign-in (setting "After sign-in, open": the MediaLab TV interface or Emby Web): a home page with a rotating banner and rows (Continue Watching, Next Up, new movies and series, one row per library, My List, collections, genres, live TV: on now, movies tonight, sports, kids, coming up); title pages (backdrop, ratings, cast, seasons and episodes, more like this, local trailer, My List, Watched); grids; search with an on-screen keyboard; profiles ("Who's watching?", hidden users excluded); sign-out.
• Its own player: audio tracks, subtitles, resume, playback reporting (shows in Continue Watching), next episode and the Skip intro / recap / credits buttons (Emby markers and Smart Skip).
• TV mode chosen by itself on Tizen, webOS, Android TV / Google TV and Philips TVs (or with a switch in the profile menu): sized for 720p, 1080p and 4K, safe margins, the remote's keys (arrows, OK, Back with a question before leaving, media, color, channel +/−, digits), the Magic Remote pointer and faster seeking.
• Data comes only from the user's own lists, with the user's token, so the server applies its rights and age limits.
• Privacy: after sign-in the TV keeps only the server token and the user name, not the password; the token is checked at every start (revoked → sign-in form). The "Remember the password on TVs" setting (off by default) keeps it only for TVs that lose the token. A password saved by 1.1 is used once, if needed, then deleted.
• The player uses the hls.js that comes with Emby Web; nothing is bundled.