Bump version to 10.8.13

Merge pull request from GHSA-866x-wj5j-2vf4
Validate codec and container
2026-01-15 23:58:57 +00:00 · 2023-11-28 22:21:57 -05:00 · 2023-11-28 22:20:32 -05:00 · 2023-11-28 22:19:55 -05:00 · 2023-11-28 15:21:32 -07:00 · 2023-11-27 00:19:32 -05:00
22 changed files with 131 additions and 75 deletions
--- a/CONTRIBUTORS.md
+++ b/CONTRIBUTORS.md
@@ -161,6 +161,7 @@
 - [MinecraftPlaye](https://github.com/MinecraftPlaye)
 - [RealGreenDragon](https://github.com/RealGreenDragon)
 - [TheTyrius](https://github.com/TheTyrius)
+ - [Çağrı Sakaoğlu](https://github.com/ilovepilav)

 # Emby Contributors

@@ -229,3 +230,6 @@
 - [gnuyent](https://github.com/gnuyent)
 - [Matthew Jones](https://github.com/matthew-jones-uk)
 - [Jakob Kukla](https://github.com/jakobkukla)
+ - [Utku Özdemir](https://github.com/utkuozdemir)
+ - [JPUC1143](https://github.com/Jpuc1143/)
+ - [0x25CBFC4F](https://github.com/0x25CBFC4F)
--- a/Emby.Naming/Emby.Naming.csproj
+++ b/Emby.Naming/Emby.Naming.csproj
@@ -36,7 +36,7 @@
  <PropertyGroup>
    <Authors>Jellyfin Contributors</Authors>
    <PackageId>Jellyfin.Naming</PackageId>
-    <VersionPrefix>10.8.11</VersionPrefix>
+    <VersionPrefix>10.8.13</VersionPrefix>
    <RepositoryUrl>https://github.com/jellyfin/jellyfin</RepositoryUrl>
    <PackageLicenseExpression>GPL-3.0-only</PackageLicenseExpression>
  </PropertyGroup>
--- a/Emby.Server.Implementations/Updates/InstallationManager.cs
+++ b/Emby.Server.Implementations/Updates/InstallationManager.cs
@@ -324,9 +324,15 @@ namespace Emby.Server.Implementations.Updates
                }

                _completedInstallationsInternal.Add(package);
-                await _eventManager.PublishAsync(isUpdate
-                    ? (GenericEventArgs<InstallationInfo>)new PluginUpdatedEventArgs(package)
-                    : new PluginInstalledEventArgs(package)).ConfigureAwait(false);
+
+                if (isUpdate)
+                {
+                    await _eventManager.PublishAsync(new PluginUpdatedEventArgs(package)).ConfigureAwait(false);
+                }
+                else
+                {
+                    await _eventManager.PublishAsync(new PluginInstalledEventArgs(package)).ConfigureAwait(false);
+                }

                _applicationHost.NotifyPendingRestart();
            }
--- a/Jellyfin.Api/Controllers/AudioController.cs
+++ b/Jellyfin.Api/Controllers/AudioController.cs
@@ -91,18 +91,18 @@ namespace Jellyfin.Api.Controllers
        [ProducesAudioFile]
        public async Task<ActionResult> GetAudioStream(
            [FromRoute, Required] Guid itemId,
-            [FromQuery] string? container,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? container,
            [FromQuery] bool? @static,
            [FromQuery] string? @params,
            [FromQuery] string? tag,
            [FromQuery] string? deviceProfileId,
            [FromQuery] string? playSessionId,
-            [FromQuery] string? segmentContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? segmentContainer,
            [FromQuery] int? segmentLength,
            [FromQuery] int? minSegments,
            [FromQuery] string? mediaSourceId,
            [FromQuery] string? deviceId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] bool? enableAutoStreamCopy,
            [FromQuery] bool? allowVideoStreamCopy,
            [FromQuery] bool? allowAudioStreamCopy,
@@ -132,8 +132,8 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] int? cpuCoreLimit,
            [FromQuery] string? liveStreamId,
            [FromQuery] bool? enableMpegtsM2TsMode,
-            [FromQuery] string? videoCodec,
-            [FromQuery] string? subtitleCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? videoCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? subtitleCodec,
            [FromQuery] string? transcodeReasons,
            [FromQuery] int? audioStreamIndex,
            [FromQuery] int? videoStreamIndex,
@@ -262,12 +262,12 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] string? tag,
            [FromQuery] string? deviceProfileId,
            [FromQuery] string? playSessionId,
-            [FromQuery] string? segmentContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? segmentContainer,
            [FromQuery] int? segmentLength,
            [FromQuery] int? minSegments,
            [FromQuery] string? mediaSourceId,
            [FromQuery] string? deviceId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] bool? enableAutoStreamCopy,
            [FromQuery] bool? allowVideoStreamCopy,
            [FromQuery] bool? allowAudioStreamCopy,
@@ -297,8 +297,8 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] int? cpuCoreLimit,
            [FromQuery] string? liveStreamId,
            [FromQuery] bool? enableMpegtsM2TsMode,
-            [FromQuery] string? videoCodec,
-            [FromQuery] string? subtitleCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? videoCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? subtitleCodec,
            [FromQuery] string? transcodeReasons,
            [FromQuery] int? audioStreamIndex,
            [FromQuery] int? videoStreamIndex,
--- a/Jellyfin.Api/Controllers/ConfigurationController.cs
+++ b/Jellyfin.Api/Controllers/ConfigurationController.cs
@@ -125,12 +125,14 @@ namespace Jellyfin.Api.Controllers
        /// <param name="mediaEncoderPath">Media encoder path form body.</param>
        /// <response code="204">Media encoder path updated.</response>
        /// <returns>Status.</returns>
+        [Obsolete("This endpoint is obsolete.")]
        [HttpPost("MediaEncoder/Path")]
        [Authorize(Policy = Policies.FirstTimeSetupOrElevated)]
        [ProducesResponseType(StatusCodes.Status204NoContent)]
        public ActionResult UpdateMediaEncoderPath([FromBody, Required] MediaEncoderPathDto mediaEncoderPath)
        {
-            _mediaEncoder.UpdateEncoderPath(mediaEncoderPath.Path, mediaEncoderPath.PathType);
+            // API ENDPOINT DISABLED (NOOP) FOR SECURITY PURPOSES
+            //_mediaEncoder.UpdateEncoderPath(mediaEncoderPath.Path, mediaEncoderPath.PathType);
            return NoContent();
        }
    }
--- a/Jellyfin.Api/Controllers/DynamicHlsController.cs
+++ b/Jellyfin.Api/Controllers/DynamicHlsController.cs
@@ -174,18 +174,18 @@ namespace Jellyfin.Api.Controllers
        [ProducesPlaylistFile]
        public async Task<ActionResult> GetLiveHlsStream(
            [FromRoute, Required] Guid itemId,
-            [FromQuery] string? container,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? container,
            [FromQuery] bool? @static,
            [FromQuery] string? @params,
            [FromQuery] string? tag,
            [FromQuery] string? deviceProfileId,
            [FromQuery] string? playSessionId,
-            [FromQuery] string? segmentContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? segmentContainer,
            [FromQuery] int? segmentLength,
            [FromQuery] int? minSegments,
            [FromQuery] string? mediaSourceId,
            [FromQuery] string? deviceId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] bool? enableAutoStreamCopy,
            [FromQuery] bool? allowVideoStreamCopy,
            [FromQuery] bool? allowAudioStreamCopy,
@@ -215,8 +215,8 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] int? cpuCoreLimit,
            [FromQuery] string? liveStreamId,
            [FromQuery] bool? enableMpegtsM2TsMode,
-            [FromQuery] string? videoCodec,
-            [FromQuery] string? subtitleCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? videoCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? subtitleCodec,
            [FromQuery] string? transcodeReasons,
            [FromQuery] int? audioStreamIndex,
            [FromQuery] int? videoStreamIndex,
@@ -426,12 +426,12 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] string? tag,
            [FromQuery] string? deviceProfileId,
            [FromQuery] string? playSessionId,
-            [FromQuery] string? segmentContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? segmentContainer,
            [FromQuery] int? segmentLength,
            [FromQuery] int? minSegments,
            [FromQuery, Required] string mediaSourceId,
            [FromQuery] string? deviceId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] bool? enableAutoStreamCopy,
            [FromQuery] bool? allowVideoStreamCopy,
            [FromQuery] bool? allowAudioStreamCopy,
@@ -463,8 +463,8 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] int? cpuCoreLimit,
            [FromQuery] string? liveStreamId,
            [FromQuery] bool? enableMpegtsM2TsMode,
-            [FromQuery] string? videoCodec,
-            [FromQuery] string? subtitleCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? videoCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? subtitleCodec,
            [FromQuery] string? transcodeReasons,
            [FromQuery] int? audioStreamIndex,
            [FromQuery] int? videoStreamIndex,
@@ -596,12 +596,12 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] string? tag,
            [FromQuery] string? deviceProfileId,
            [FromQuery] string? playSessionId,
-            [FromQuery] string? segmentContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? segmentContainer,
            [FromQuery] int? segmentLength,
            [FromQuery] int? minSegments,
            [FromQuery, Required] string mediaSourceId,
            [FromQuery] string? deviceId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] bool? enableAutoStreamCopy,
            [FromQuery] bool? allowVideoStreamCopy,
            [FromQuery] bool? allowAudioStreamCopy,
@@ -632,8 +632,8 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] int? cpuCoreLimit,
            [FromQuery] string? liveStreamId,
            [FromQuery] bool? enableMpegtsM2TsMode,
-            [FromQuery] string? videoCodec,
-            [FromQuery] string? subtitleCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? videoCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? subtitleCodec,
            [FromQuery] string? transcodeReasons,
            [FromQuery] int? audioStreamIndex,
            [FromQuery] int? videoStreamIndex,
@@ -762,12 +762,12 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] string? tag,
            [FromQuery] string? deviceProfileId,
            [FromQuery] string? playSessionId,
-            [FromQuery] string? segmentContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? segmentContainer,
            [FromQuery] int? segmentLength,
            [FromQuery] int? minSegments,
            [FromQuery] string? mediaSourceId,
            [FromQuery] string? deviceId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] bool? enableAutoStreamCopy,
            [FromQuery] bool? allowVideoStreamCopy,
            [FromQuery] bool? allowAudioStreamCopy,
@@ -799,8 +799,8 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] int? cpuCoreLimit,
            [FromQuery] string? liveStreamId,
            [FromQuery] bool? enableMpegtsM2TsMode,
-            [FromQuery] string? videoCodec,
-            [FromQuery] string? subtitleCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? videoCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? subtitleCodec,
            [FromQuery] string? transcodeReasons,
            [FromQuery] int? audioStreamIndex,
            [FromQuery] int? videoStreamIndex,
@@ -930,12 +930,12 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] string? tag,
            [FromQuery] string? deviceProfileId,
            [FromQuery] string? playSessionId,
-            [FromQuery] string? segmentContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? segmentContainer,
            [FromQuery] int? segmentLength,
            [FromQuery] int? minSegments,
            [FromQuery] string? mediaSourceId,
            [FromQuery] string? deviceId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] bool? enableAutoStreamCopy,
            [FromQuery] bool? allowVideoStreamCopy,
            [FromQuery] bool? allowAudioStreamCopy,
@@ -966,8 +966,8 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] int? cpuCoreLimit,
            [FromQuery] string? liveStreamId,
            [FromQuery] bool? enableMpegtsM2TsMode,
-            [FromQuery] string? videoCodec,
-            [FromQuery] string? subtitleCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? videoCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? subtitleCodec,
            [FromQuery] string? transcodeReasons,
            [FromQuery] int? audioStreamIndex,
            [FromQuery] int? videoStreamIndex,
@@ -1107,12 +1107,12 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] string? tag,
            [FromQuery] string? deviceProfileId,
            [FromQuery] string? playSessionId,
-            [FromQuery] string? segmentContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? segmentContainer,
            [FromQuery] int? segmentLength,
            [FromQuery] int? minSegments,
            [FromQuery] string? mediaSourceId,
            [FromQuery] string? deviceId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] bool? enableAutoStreamCopy,
            [FromQuery] bool? allowVideoStreamCopy,
            [FromQuery] bool? allowAudioStreamCopy,
@@ -1144,8 +1144,8 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] int? cpuCoreLimit,
            [FromQuery] string? liveStreamId,
            [FromQuery] bool? enableMpegtsM2TsMode,
-            [FromQuery] string? videoCodec,
-            [FromQuery] string? subtitleCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? videoCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? subtitleCodec,
            [FromQuery] string? transcodeReasons,
            [FromQuery] int? audioStreamIndex,
            [FromQuery] int? videoStreamIndex,
@@ -1288,12 +1288,12 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] string? tag,
            [FromQuery] string? deviceProfileId,
            [FromQuery] string? playSessionId,
-            [FromQuery] string? segmentContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? segmentContainer,
            [FromQuery] int? segmentLength,
            [FromQuery] int? minSegments,
            [FromQuery] string? mediaSourceId,
            [FromQuery] string? deviceId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] bool? enableAutoStreamCopy,
            [FromQuery] bool? allowVideoStreamCopy,
            [FromQuery] bool? allowAudioStreamCopy,
@@ -1324,8 +1324,8 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] int? cpuCoreLimit,
            [FromQuery] string? liveStreamId,
            [FromQuery] bool? enableMpegtsM2TsMode,
-            [FromQuery] string? videoCodec,
-            [FromQuery] string? subtitleCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? videoCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? subtitleCodec,
            [FromQuery] string? transcodeReasons,
            [FromQuery] int? audioStreamIndex,
            [FromQuery] int? videoStreamIndex,
--- a/Jellyfin.Api/Controllers/ItemsController.cs
+++ b/Jellyfin.Api/Controllers/ItemsController.cs
@@ -244,7 +244,8 @@ namespace Jellyfin.Api.Controllers
                .AddAdditionalDtoOptions(enableImages, enableUserData, imageTypeLimit, enableImageTypes);

            if (includeItemTypes.Length == 1
-                && includeItemTypes[0] == BaseItemKind.BoxSet)
+                && (includeItemTypes[0] == BaseItemKind.Playlist
+                    || includeItemTypes[0] == BaseItemKind.BoxSet))
            {
                parentId = null;
            }
--- a/Jellyfin.Api/Controllers/UniversalAudioController.cs
+++ b/Jellyfin.Api/Controllers/UniversalAudioController.cs
@@ -102,13 +102,13 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] string? mediaSourceId,
            [FromQuery] string? deviceId,
            [FromQuery] Guid? userId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] int? maxAudioChannels,
            [FromQuery] int? transcodingAudioChannels,
            [FromQuery] int? maxStreamingBitrate,
            [FromQuery] int? audioBitRate,
            [FromQuery] long? startTimeTicks,
-            [FromQuery] string? transcodingContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? transcodingContainer,
            [FromQuery] string? transcodingProtocol,
            [FromQuery] int? maxAudioSampleRate,
            [FromQuery] int? maxAudioBitDepth,
--- a/Jellyfin.Api/Controllers/VideosController.cs
+++ b/Jellyfin.Api/Controllers/VideosController.cs
@@ -318,18 +318,18 @@ namespace Jellyfin.Api.Controllers
        [ProducesVideoFile]
        public async Task<ActionResult> GetVideoStream(
            [FromRoute, Required] Guid itemId,
-            [FromQuery] string? container,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? container,
            [FromQuery] bool? @static,
            [FromQuery] string? @params,
            [FromQuery] string? tag,
            [FromQuery] string? deviceProfileId,
            [FromQuery] string? playSessionId,
-            [FromQuery] string? segmentContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? segmentContainer,
            [FromQuery] int? segmentLength,
            [FromQuery] int? minSegments,
            [FromQuery] string? mediaSourceId,
            [FromQuery] string? deviceId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] bool? enableAutoStreamCopy,
            [FromQuery] bool? allowVideoStreamCopy,
            [FromQuery] bool? allowAudioStreamCopy,
@@ -361,8 +361,8 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] int? cpuCoreLimit,
            [FromQuery] string? liveStreamId,
            [FromQuery] bool? enableMpegtsM2TsMode,
-            [FromQuery] string? videoCodec,
-            [FromQuery] string? subtitleCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? videoCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? subtitleCodec,
            [FromQuery] string? transcodeReasons,
            [FromQuery] int? audioStreamIndex,
            [FromQuery] int? videoStreamIndex,
@@ -578,12 +578,12 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] string? tag,
            [FromQuery] string? deviceProfileId,
            [FromQuery] string? playSessionId,
-            [FromQuery] string? segmentContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? segmentContainer,
            [FromQuery] int? segmentLength,
            [FromQuery] int? minSegments,
            [FromQuery] string? mediaSourceId,
            [FromQuery] string? deviceId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] bool? enableAutoStreamCopy,
            [FromQuery] bool? allowVideoStreamCopy,
            [FromQuery] bool? allowAudioStreamCopy,
@@ -615,8 +615,8 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] int? cpuCoreLimit,
            [FromQuery] string? liveStreamId,
            [FromQuery] bool? enableMpegtsM2TsMode,
-            [FromQuery] string? videoCodec,
-            [FromQuery] string? subtitleCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? videoCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? subtitleCodec,
            [FromQuery] string? transcodeReasons,
            [FromQuery] int? audioStreamIndex,
            [FromQuery] int? videoStreamIndex,
--- a/Jellyfin.Data/Jellyfin.Data.csproj
+++ b/Jellyfin.Data/Jellyfin.Data.csproj
@@ -18,7 +18,7 @@
  <PropertyGroup>
    <Authors>Jellyfin Contributors</Authors>
    <PackageId>Jellyfin.Data</PackageId>
-    <VersionPrefix>10.8.11</VersionPrefix>
+    <VersionPrefix>10.8.13</VersionPrefix>
    <RepositoryUrl>https://github.com/jellyfin/jellyfin</RepositoryUrl>
    <PackageLicenseExpression>GPL-3.0-only</PackageLicenseExpression>
  </PropertyGroup>
--- a/MediaBrowser.Common/MediaBrowser.Common.csproj
+++ b/MediaBrowser.Common/MediaBrowser.Common.csproj
@@ -8,7 +8,7 @@
  <PropertyGroup>
    <Authors>Jellyfin Contributors</Authors>
    <PackageId>Jellyfin.Common</PackageId>
-    <VersionPrefix>10.8.11</VersionPrefix>
+    <VersionPrefix>10.8.13</VersionPrefix>
    <RepositoryUrl>https://github.com/jellyfin/jellyfin</RepositoryUrl>
    <PackageLicenseExpression>GPL-3.0-only</PackageLicenseExpression>
  </PropertyGroup>
--- a/MediaBrowser.Controller/MediaBrowser.Controller.csproj
+++ b/MediaBrowser.Controller/MediaBrowser.Controller.csproj
@@ -8,7 +8,7 @@
  <PropertyGroup>
    <Authors>Jellyfin Contributors</Authors>
    <PackageId>Jellyfin.Controller</PackageId>
-    <VersionPrefix>10.8.11</VersionPrefix>
+    <VersionPrefix>10.8.13</VersionPrefix>
    <RepositoryUrl>https://github.com/jellyfin/jellyfin</RepositoryUrl>
    <PackageLicenseExpression>GPL-3.0-only</PackageLicenseExpression>
  </PropertyGroup>
--- a/MediaBrowser.Controller/MediaEncoding/EncodingHelper.cs
+++ b/MediaBrowser.Controller/MediaEncoding/EncodingHelper.cs
@@ -25,6 +25,11 @@ namespace MediaBrowser.Controller.MediaEncoding
 {
    public class EncodingHelper
    {
+        /// <summary>
+        /// The codec validation regex.
+        /// </summary>
+        public const string ValidationRegex = @"^[a-zA-Z0-9\-\._,|]{0,40}$";
+
        private const string QsvAlias = "qs";
        private const string VaapiAlias = "va";
        private const string D3d11vaAlias = "dx11";
@@ -36,6 +41,8 @@ namespace MediaBrowser.Controller.MediaEncoding
        private readonly ISubtitleEncoder _subtitleEncoder;
        private readonly IConfiguration _config;

+        private static readonly Regex _validationRegex = new(ValidationRegex, RegexOptions.Compiled);
+
        // i915 hang was fixed by linux 6.2 (3f882f2)
        private readonly Version _minKerneli915Hang = new Version(5, 18);
        private readonly Version _maxKerneli915Hang = new Version(6, 1, 3);
@@ -253,7 +260,10 @@ namespace MediaBrowser.Controller.MediaEncoding
                    return "libtheora";
                }

-                return codec.ToLowerInvariant();
+                if (_validationRegex.IsMatch(codec))
+                {
+                    return codec.ToLowerInvariant();
+                }
            }

            return "copy";
@@ -276,7 +286,7 @@ namespace MediaBrowser.Controller.MediaEncoding

        public static string GetInputFormat(string container)
        {
-            if (string.IsNullOrEmpty(container))
+            if (string.IsNullOrEmpty(container) || !_validationRegex.IsMatch(container))
            {
                return null;
            }
@@ -523,6 +533,11 @@ namespace MediaBrowser.Controller.MediaEncoding
        {
            var codec = state.OutputAudioCodec;

+            if (!_validationRegex.IsMatch(codec))
+            {
+                codec = "aac";
+            }
+
            if (string.Equals(codec, "aac", StringComparison.OrdinalIgnoreCase))
            {
                // Use libfdk_aac for better audio quality if using custom build of FFmpeg which has fdk_aac support
@@ -627,14 +642,20 @@ namespace MediaBrowser.Controller.MediaEncoding
        private string GetVaapiDeviceArgs(string renderNodePath, string driver, string kernelDriver, string alias)
        {
            alias ??= VaapiAlias;
-            renderNodePath = renderNodePath ?? "/dev/dri/renderD128";
-            var options = string.IsNullOrEmpty(driver)
-                ? renderNodePath
-                : ",driver=" + driver + (string.IsNullOrEmpty(kernelDriver) ? string.Empty : ",kernel_driver=" + kernelDriver);
+
+            // 'renderNodePath' has higher priority than 'kernelDriver'
+            var driverOpts = string.IsNullOrEmpty(renderNodePath)
+                ? (string.IsNullOrEmpty(kernelDriver) ? string.Empty : ",kernel_driver=" + kernelDriver)
+                : renderNodePath;
+
+            // 'driver' behaves similarly to env LIBVA_DRIVER_NAME
+            driverOpts += string.IsNullOrEmpty(driver) ? string.Empty : ",driver=" + driver;
+
+            var options = string.IsNullOrEmpty(driverOpts) ? string.Empty : ":" + driverOpts;

            return string.Format(
                CultureInfo.InvariantCulture,
-                " -init_hw_device vaapi={0}:{1}",
+                " -init_hw_device vaapi={0}{1}",
                alias,
                options);
        }
@@ -739,14 +760,14 @@ namespace MediaBrowser.Controller.MediaEncoding

                if (_mediaEncoder.IsVaapiDeviceInteliHD)
                {
-                    args.Append(GetVaapiDeviceArgs(null, "iHD", null, VaapiAlias));
+                    args.Append(GetVaapiDeviceArgs(options.VaapiDevice, "iHD", null, VaapiAlias));
                }
                else if (_mediaEncoder.IsVaapiDeviceInteli965)
                {
                    // Only override i965 since it has lower priority than iHD in libva lookup.
                    Environment.SetEnvironmentVariable("LIBVA_DRIVER_NAME", "i965");
                    Environment.SetEnvironmentVariable("LIBVA_DRIVER_NAME_JELLYFIN", "i965");
-                    args.Append(GetVaapiDeviceArgs(null, "i965", null, VaapiAlias));
+                    args.Append(GetVaapiDeviceArgs(options.VaapiDevice, "i965", null, VaapiAlias));
                }
                else
                {
@@ -2070,7 +2091,7 @@ namespace MediaBrowser.Controller.MediaEncoding
            var outputScaleFactor = GetVideoBitrateScaleFactor(outputVideoCodec);

            // Don't scale the real bitrate lower than the requested bitrate
-            var scaleFactor = Math.Min(outputScaleFactor / inputScaleFactor, 1);
+            var scaleFactor = Math.Max(outputScaleFactor / inputScaleFactor, 1);

            if (bitrate <= 500000)
            {
--- a/MediaBrowser.Model/MediaBrowser.Model.csproj
+++ b/MediaBrowser.Model/MediaBrowser.Model.csproj
@@ -8,7 +8,7 @@
  <PropertyGroup>
    <Authors>Jellyfin Contributors</Authors>
    <PackageId>Jellyfin.Model</PackageId>
-    <VersionPrefix>10.8.11</VersionPrefix>
+    <VersionPrefix>10.8.13</VersionPrefix>
    <RepositoryUrl>https://github.com/jellyfin/jellyfin</RepositoryUrl>
    <PackageLicenseExpression>GPL-3.0-only</PackageLicenseExpression>
  </PropertyGroup>
--- a/SharedVersion.cs
+++ b/SharedVersion.cs
@@ -1,4 +1,4 @@
 using System.Reflection;

-[assembly: AssemblyVersion("10.8.11")]
-[assembly: AssemblyFileVersion("10.8.11")]
+[assembly: AssemblyVersion("10.8.13")]
+[assembly: AssemblyFileVersion("10.8.13")]
--- a/build.yaml
+++ b/build.yaml
@@ -1,7 +1,7 @@
 ---
 # We just wrap `build` so this is really it
 name: "jellyfin"
-version: "10.8.11"
+version: "10.8.13"
 packages:
  - debian.amd64
  - debian.arm64
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,15 @@
+jellyfin-server (10.8.13-1) unstable; urgency=medium
+
+  * New upstream version 10.8.13; release changelog at https://github.com/jellyfin/jellyfin/releases/tag/v10.8.13
+
+ -- Jellyfin Packaging Team <packaging@jellyfin.org>  Tue, 28 Nov 2023 22:21:55 -0500
+
+jellyfin-server (10.8.12-1) unstable; urgency=medium
+
+  * New upstream version 10.8.12; release changelog at https://github.com/jellyfin/jellyfin/releases/tag/v10.8.12
+
+ -- Jellyfin Packaging Team <packaging@jellyfin.org>  Sat, 04 Nov 2023 14:42:37 -0400
+
 jellyfin-server (10.8.11-1) unstable; urgency=medium

  * New upstream version 10.8.11; release changelog at https://github.com/jellyfin/jellyfin/releases/tag/v10.8.11
--- a/debian/conf/jellyfin
+++ b/debian/conf/jellyfin
@@ -27,6 +27,9 @@ JELLYFIN_RESTART_OPT="--restartpath=/usr/lib/jellyfin/restart.sh"
 # ffmpeg binary paths, overriding the system values
 JELLYFIN_FFMPEG_OPT="--ffmpeg=/usr/lib/jellyfin-ffmpeg/ffmpeg"

+# Disable glibc dynamic heap adjustment
+MALLOC_TRIM_THRESHOLD_=131072
+
 # [OPTIONAL] run Jellyfin as a headless service
 #JELLYFIN_SERVICE_OPT="--service"

--- a/debian/metapackage/jellyfin
+++ b/debian/metapackage/jellyfin
@@ -5,7 +5,7 @@ Homepage: https://jellyfin.org
 Standards-Version: 3.9.2

 Package: jellyfin
-Version: 10.8.11
+Version: 10.8.13
 Maintainer: Jellyfin Packaging Team <packaging@jellyfin.org>
 Depends: jellyfin-server, jellyfin-web
 Description: Provides the Jellyfin Free Software Media System
--- a/fedora/jellyfin.env
+++ b/fedora/jellyfin.env
@@ -26,6 +26,9 @@ JELLYFIN_CACHE_DIR="/var/cache/jellyfin"
 # In-App service control
 JELLYFIN_RESTART_OPT="--restartpath=/usr/libexec/jellyfin/restart.sh"

+# Disable glibc dynamic heap adjustment
+MALLOC_TRIM_THRESHOLD_=131072
+
 # [OPTIONAL] ffmpeg binary paths, overriding the UI-configured values
 #JELLYFIN_FFMPEG_OPT="--ffmpeg=/usr/bin/ffmpeg"

--- a/fedora/jellyfin.spec
+++ b/fedora/jellyfin.spec
@@ -7,7 +7,7 @@
 %endif

 Name:           jellyfin
-Version:        10.8.11
+Version:        10.8.13
 Release:        1%{?dist}
 Summary:        The Free Software Media System
 License:        GPLv2
@@ -179,6 +179,10 @@ fi
 %systemd_postun_with_restart jellyfin.service

 %changelog
+* Tue Nov 28 2023 Jellyfin Packaging Team <packaging@jellyfin.org>
+- New upstream version 10.8.13; release changelog at https://github.com/jellyfin/jellyfin/releases/tag/v10.8.13
+* Sat Nov 04 2023 Jellyfin Packaging Team <packaging@jellyfin.org>
+- New upstream version 10.8.12; release changelog at https://github.com/jellyfin/jellyfin/releases/tag/v10.8.12
 * Sat Sep 23 2023 Jellyfin Packaging Team <packaging@jellyfin.org>
 - New upstream version 10.8.11; release changelog at https://github.com/jellyfin/jellyfin/releases/tag/v10.8.11
 * Sun Apr 23 2023 Jellyfin Packaging Team <packaging@jellyfin.org>
--- a/src/Jellyfin.Extensions/Jellyfin.Extensions.csproj
+++ b/src/Jellyfin.Extensions/Jellyfin.Extensions.csproj
@@ -13,7 +13,7 @@
  <PropertyGroup>
    <Authors>Jellyfin Contributors</Authors>
    <PackageId>Jellyfin.Extensions</PackageId>
-    <VersionPrefix>10.8.11</VersionPrefix>
+    <VersionPrefix>10.8.13</VersionPrefix>
    <RepositoryUrl>https://github.com/jellyfin/jellyfin</RepositoryUrl>
    <PackageLicenseExpression>GPL-3.0-only</PackageLicenseExpression>
  </PropertyGroup>
Author	SHA1	Message	Date
Joshua M. Boniface	e93d03d8cb	Bump version to 10.8.13	2023-11-28 22:21:57 -05:00
Joshua M. Boniface	a656799dc8	Merge pull request from GHSA-866x-wj5j-2vf4 Validate codec and container	2023-11-28 22:20:32 -05:00
Joshua M. Boniface	83d2c69516	Merge pull request from GHSA-rr9h-w522-cvmr Remove the functionality of /System/MediaEncoder/Path	2023-11-28 22:19:55 -05:00
Cody Robibero	204fdeb035	Validate codec and container	2023-11-28 15:21:32 -07:00
Joshua M. Boniface	c4cdcb73fc	Merge pull request #10625 from ilovepilav/fix-alerts-missing-from-admin-dashboard Fix: Plugin Installed Alerts missing from Admin Dashboard #10620 (cherry picked from commit `2f6536e34b`) Signed-off-by: Joshua M. Boniface <joshua@boniface.me>	2023-11-27 00:19:32 -05:00
Joshua M. Boniface	1e0bd32358	Set Path endpoint obsolete	2023-11-26 18:33:13 -05:00
Joshua M. Boniface	bf5f00a383	Restore original flag behaviour	2023-11-23 13:25:36 -05:00
Joshua M. Boniface	0430ffecb6	Restore ordering	2023-11-23 01:44:35 -05:00
Joshua M. Boniface	85cfd080f1	Remove the functionality of /System/MediaEncoder/Path Eliminate this endpoint by having it perform no action, pending total removal in the next major version (10.9.0). Further, adjust the MediaEncoder startup options to completely ignore what is in the XML currently, and respect only the "--ffmpeg" arg, which is set on most of our platforms, falling back to system "ffmpeg" in $PATH if not found. This ensures that, should the "--ffmpeg" arg be changed by an administrator wishing to alter the default FFmpeg binary, this change will be reflected properly on next startup.	2023-11-22 21:29:32 -05:00
Joshua M. Boniface	a173d01139	Revert "Merge pull request #10514 from Bond-009/skia3" This reverts commit `0bac1eab98`, reversing changes made to `4df1003029`. Causes segfaults on startup.	2023-11-05 11:47:36 -05:00
Joshua M. Boniface	3e7fad55de	Bump version to 10.8.12	2023-11-04 14:42:59 -04:00
Joshua M. Boniface	8cd685a4e9	Merge pull request #10528 from nyanmisaka/backport-10451 Fix mismatched intel VAAPI UMD/KMD - Backport #10451	2023-11-04 14:36:05 -04:00
Joshua M. Boniface	9d565bbb83	Merge pull request #10454 from Shadowghost/env Add MALLOC_TRIM_THRESHOLD_ to default ENV	2023-11-04 14:16:10 -04:00
nyanmisaka	ab855af95e	Fix mismatched intel VAAPI UMD/KMD introduced by pull request #10451 Signed-off-by: nyanmisaka <nst799610810@gmail.com>	2023-11-05 01:09:07 +08:00
Claus Vium	0bac1eab98	Merge pull request #10514 from Bond-009/skia3 Update SkiaSharp (v2.88.6) and BlurHashSharp (v1.3.1)	2023-11-02 08:58:34 +01:00
Bond_009	97c2ba0115	Update SkiaSharp (v2.88.6) and BlurHashSharp (v1.3.1)	2023-11-01 23:47:04 +01:00
Cody Robibero	4df1003029	Merge pull request #10487 from thornbill/backport-9485 Fix scaleFactor limit - Backport #9738	2023-10-28 08:44:56 -06:00
Oliver Weyhmüller	3269ce56ca	Fix scaleFactor limitation to 1 introduced by pull request #9485	2023-10-28 01:02:27 -04:00
Claus Vium	ce8eddd484	Merge pull request #10406 from thornbill/fix-playlists Fix playlist listings	2023-10-27 09:47:11 +02:00
Shadowghost	5e2872509a	Add MALLOC_TRIM_THRESHOLD_=131072 to default ENV	2023-10-22 17:55:36 +02:00
Bill Thornton	d3f4dcf6f6	Revert "Don't ignore parentId for playlists" This reverts commit `98c6c34fbb`.	2023-10-15 02:16:27 -04:00