Fixed (licensing): the license key field is always visible, so a new key can be activated even while the saved license still shows as active; a refused key no longer replaces the saved key and the page shows why; when the last check fails (for example a deleted or revoked license), the page and the log show a warning with the date until which the saved license keeps working; activation, manual checks and release are written to the log.
Historique des versions de Headend
Toutes les versions publiées, de la plus récente à la plus ancienne. Les versions compilées de nos plugins Jellyfin et leur code source complet sont publics (GPL-3.0) ; le plugin a besoin d’une licence pour fonctionner. Les abonnements et les essais reçoivent toujours la dernière version, les licences à vie reçoivent les mises à jour pendant leur période de mises à jour.
1.0.8
Dernière- Loads on any Jellyfin 12.2 (official Docker image and .deb): no Jellyfin.Api dependency.
- Adult channels test: 11/11.
- Security: complete escaping (including quotes) on the admin pages, so channel names or errors from IPTV/EPG lists cannot run code; addresses coming from IPTV lists, guides and logos can no longer target the local network or the server itself (the configured receiver stays allowed on its streaming port; new option "Local network IPTV sources", switched on automatically on upgrade if saved sources are already on the local network); dependency install no longer runs anything through sudo — the page shows a root command that verifies the scripts' SHA-256; persistent PIN attempt limits with growing lockouts and a server-wide budget (new PINs need at least 6 digits; the existing PIN keeps working); adult channels left open without an unlocked viewer are closed; the live buffer and downloads (playlists, XMLTV, catalog) are bounded; IPTV addresses are logged without account and password; the receiver's SSH user is validated; backups no longer contain the PIN hash.
- Security: adult channels start only for the unlocked user who requests them; 120-minute default buffer on new installs (and "unlimited" is capped at 6 hours).
- Security (licensing): logs sent to medialab.works or exported no longer contain tokens, passwords or keys (lines are selected by the plugin's logger and secrets are masked); unencrypted license-server replies are refused; update and rollback install only packages with a verified MediaLab signature (and a size limit); the log export no longer puts the token in the URL; the License page escapes text in attributes correctly.
- Fixed: the active-license badge in the page header is readable on the dark theme (the text is no longer black).
- Also includes the changes from 1.0.5: private defaults for new installs, the receiver's SSH host key verified, the OpenWebif password encrypted.
- Privacy, NEW installations only: the receiver SSH watchdog and the external sources (iptv-org channels and genres, guides from programetv.ro, cinemagia.ro, epgshare01 and open-epg) start switched off; on first setup the Headend page shows a checklist explaining what each one contacts, with checkboxes. Existing installations keep all their settings (detected by the settings file existing at startup; ConfigVersion 3).
- The watchdog now verifies the receiver's SSH host key (trust on first use): the key is saved at the first connection in the plugin data folder, and if it changes the command is not sent and a clear message is shown. The watchdog card shows the saved fingerprint and a "Forget saved key" button (after reflashing the receiver).
- The receivers' OpenWebif password is no longer stored in plain text in the plugin configuration: it is encrypted at rest (AES-256-GCM, key bound to the server id, files with mode 600) and never sent to the browser; the receiver page only shows "set ✓" (type to replace, "Clear" to remove). Existing passwords are moved automatically on first start.
- Security (critical): GET/POST /Headend/LiveTvOptions required no authentication: anyone could read and change the server's Live TV options (including the program run after recordings, i.e. command execution on the server). They now require an administrator. New test: every API action declares its access explicitly. Update immediately.
- Privacy: the payment QR code on the License page is generated locally, without the third-party QR service.