Historique des versions de Registration

• Security: a TV's Quick Connect code is approved for the new account only if the visitor explicitly ticks "This will also sign in: the TV showing this code (code …)". A code that arrives in a link (?code=) no longer signs anything in without the tick.
• Security: the visitor's country (CF-IPCountry) is read only from connections that come from Cloudflare's network (new setting "The server is behind Cloudflare", on by default; also on automatically when Edge Shield has its zone connected); a client can no longer pass the country filter by sending the header itself.
• Security: the public QR code (/Registration/Qr) can no longer be cached and no longer uses the Host header: the address comes from "Public address" or from the server's published address.
• Security: on the admin page, text that comes from visitors (for example the browser) is now fully escaped inside attributes too.
• New accounts cannot manage collections or lyrics (EnableCollectionManagement / EnableLyricManagement forced off).
• Wrong code attempts and statistics counters no longer rewrite the data file on every anonymous request; the block and attempt lists are capped (5000) and pruned; abuse alerts to the admin are grouped (at most one every 10 minutes, with the number grouped).
• Approving, rejecting, activating after payment and email confirmation are atomic: a double click or a payment arriving together with an approval no longer sends duplicate emails.
• Turnstile: the token must have been solved on the "Public address" host; the check is required only when both keys are set. The browser report accepts only known steps. A new family code must have at least 8 characters (the existing one keeps working).
• Licensing: license server responses must be sealed, release descriptors (update / rollback) are signature-checked, exported logs no longer contain tokens.
• Fixed: the Turnstile widget on the registration page did not start (its container is now called cf-turnstile; the fix was already in the 1.0.4 package but was not mentioned).
• For other MediaLab plugins: the Turnstile keys can also be used by MediaLab TV (Registration.Integration.SharedTurnstile).

• Privacy: the payment QR code on the License page is now generated locally, in the page; the payment link is no longer sent to a third-party QR service (api.qrserver.com).
• Privacy: the SMTP password, the Telegram bot token, the Turnstile secret key and the form HMAC key are no longer stored in plain text in the plugin configuration: they are encrypted at rest (AES-256-GCM, random key bound to the server id, files with mode 600 in the plugin data folder) and are never sent to the browser. The page only shows "set ✓" — type a new value to replace it or press "Clear". On first start the existing values are moved automatically and blanked in the XML; nothing has to be re-entered.
• The README now describes the Jellyfin version (it previously contained the Emby text).

• The page's QR code (Registration/Qr?code=) can carry the TV's Quick Connect code: the sign-up form opens with the code already filled in.

• Third-party component licenses (MIT) are included in the package (THIRD-PARTY-NOTICES.txt).
• Plugin name in Jellyfin: "Registration by MediaLab". Author: MediaLab Works.

• License page: trial and purchase now use the Jellyfin products (jf-bundle, jf-<plugin>) instead of the Emby ones; this is also corrected on the server side for older pages.
• After a rollback, Jellyfin's "Update Plugins" task no longer reinstalls the newer version: automatic updates are turned off for the rolled-back version and turned on again with the next "Install update". The state is shown on the License page.

First release for Jellyfin 12.2 or newer (GPL-3.0, source code included).