Fixed (licensing): the license key field is always visible, so a new key can be activated even while the saved license still shows as active; a refused key no longer replaces the saved key and the page shows why; when the last check fails (for example a deleted or revoked license), the page and the log show a warning with the date until which the saved license keeps working; activation, manual checks and release are written to the log.
Registro de cambios de Access Log
Todas las versiones publicadas, de la más reciente a la más antigua. Las compilaciones de nuestros plugins para Jellyfin y su código fuente completo son públicos (GPL-3.0); el plugin necesita una licencia para funcionar. Las suscripciones y las pruebas siempre reciben la última versión, y las licencias de por vida reciben actualizaciones dentro de su período de actualizaciones.
1.0.5
Última- Security: the log page now also escapes quotes, so a User-Agent, X-Forwarded-For or device name sent by an unauthenticated client can no longer break out of HTML attributes (title) and run code in the administrator's browser (AL-1).
- Security: Cloudflare headers (cf-ray, cdn-loop, CF-IPCountry) are trusted only when the connection comes from Cloudflare's ranges, localhost, a trusted proxy or a proxy accepted by Jellyfin (KnownProxies); from anyone else they are flagged as possibly forged (AL-2).
- New settings: "Trusted proxies" (IP or CIDR; empty = localhost only) and "The server is behind Cloudflare" (on by default; also considered on when Edge Shield has a connected Cloudflare zone).
- Security: bounded memory and CPU under attack — tracked devices and addresses are capped, User-Agent / X-Forwarded-For are cut to 512 characters, failed sign-ins are counted per address (no scan of the whole log), more than 100 attempts per address in 15 minutes are only counted, at most 100,000 events are kept in memory (the rest stay on disk), and event writing uses a bounded queue (AL-3).
- Security: the CSV export quotes every field and neutralises formulas (leading = + - @ TAB CR) (AL-5).
- Security: alerts in the Jellyfin activity log no longer contain the characters < > " ' & or control characters from user, device, app, X-Forwarded-For or provider names, and their length is limited (AL-8).
- CGNAT addresses (100.64.0.0/10) are no longer treated as the local network (AL-7).
- Licensing: unencrypted licence-server responses are refused, updates and rollback verify the package signature, exported logs no longer contain tokens, monotonic clock for the grace period; licence-bar badge colour on dark themes.
- Plugin name in Jellyfin: "Access Log by MediaLab". Author: MediaLab Works.
- License page: trial and purchase now use the Jellyfin products (
jf-bundle,jf-<plugin>) instead of the Emby ones; this is also corrected on the server side for older pages. - After a rollback, Jellyfin's "Update Plugins" task no longer reinstalls the newer version: automatic updates are turned off for the rolled-back version and turned on again with the next "Install update". The state is shown on the License page.
First release for Jellyfin 12.2 or newer (GPL-3.0, source code included).