Fixed: the "License" link on the main page did not open the License page in Emby 4.10; the page now has the common MediaLab header (icon, title, the license status badge opening the License page, and a banner when the license is not active).
Registro de cambios de Edge Shield
Todas las versiones publicadas, de la más reciente a la más antigua. Las descargas están en tu cuenta; las suscripciones y las pruebas siempre reciben la última versión, y las licencias de por vida reciben actualizaciones dentro de su período de actualizaciones.
0.1.4
Requiere Emby Server 4.10.1.0+Fixed (licensing): the license key field is always visible, so a new key can be activated even while the saved license still shows as active; a refused key no longer replaces the saved key and the page shows why; when the last check fails (for example a deleted or revoked license), the page and the log show a warning with the date until which the saved license keeps working; activation, manual checks and release are written to the log.
0.1.3
Requiere Emby Server 4.10.1.0+- Security (audit): Edge Shield no longer sets Emby's ProxyHeaderMode=AllAddresses. With it, Emby trusted the X-Forwarded-For header from anyone, and the direct (DNS only) host is public: anyone could get someone else's IP banned, evade a ban or bypass the "remote access" restriction. The plugin now computes the real IP itself: CF-Connecting-IP only from Cloudflare's ranges, X-Forwarded-For only from the server itself and from "Trusted proxies" (new setting). On first start, an AllAddresses set by an earlier version is put back to Emby's default; the same happens on disconnect, when the rules are removed and when the mode changes. The check flags AllAddresses.
- Bans are enforced inside Emby too, not only at Cloudflare: requests from banned IPs (login included) get 403, and the sessions used from them are signed out.
- Failed logins on any variant of the login path (case, trailing "/", "//") are also caught by the Cloudflare rate-limit rule.
- Limits: at most 5000 bans and 10 000 repeat-offence records (an offence decays after 30 days without a ban); batched saves; a warning when the Cloudflare IP list nears the account limit.
- Manual range blocks: at least /16 (IPv4) and /32 (IPv6), refused when they touch the LAN, the allowlist, Cloudflare or the server's own addresses. Unblocking also clears the repeat-offence history.
- Without a license: Under Attack still switches off on time and expired bans leave the Cloudflare list; unblocking and switching Under Attack off always work.
- Secret files (token key, state, certificate and its password, license) are created with mode 600 from the start, folders 700; each certificate has its own password.
- The client app name reaches the Cloudflare list only with safe characters, 64 at most.
- Cloudflare IP ranges are sanity-checked (no 0.0.0.0/0, ::/0 or overly wide prefixes); hidden settings (API, ACME) can no longer be changed through the generic configuration; ACME TXT records are removed even when the server shuts down.
- License: exported or sent logs no longer contain tokens; updates are verified by signature.
0.1.2
Requiere Emby Server 4.10.1.0+- Privacy: the payment QR code on the License page is now generated locally, in the page; the payment link is no longer sent to a third-party QR service (api.qrserver.com).
0.1.1
Requiere Emby Server 4.10.1.0+First release: Cloudflare connection (encrypted token), DNS + DDNS, SSL Full (strict) and TLS settings, Let's Encrypt certificate through DNS-01, Cloudflare rules (video streams redirected straight to the server, no caching of media, block list, spoofed IP headers, countries, login rate limit, origin port), real client IP, automatic blocking of IPs with failed logins (the attempted username stays on your server, it is not sent to Cloudflare), timed Under Attack, status page with fixes.