Bump version to 10.8.13

Merge pull request from GHSA-866x-wj5j-2vf4
Validate codec and container
2026-01-16 08:08:16 +00:00 · 2023-11-28 22:21:57 -05:00 · 2023-11-28 22:20:32 -05:00 · 2023-11-28 22:19:55 -05:00 · 2023-11-28 15:21:32 -07:00 · 2023-11-27 00:19:32 -05:00
19 changed files with 101 additions and 66 deletions
--- a/CONTRIBUTORS.md
+++ b/CONTRIBUTORS.md
@@ -161,6 +161,7 @@
 - [MinecraftPlaye](https://github.com/MinecraftPlaye)
 - [RealGreenDragon](https://github.com/RealGreenDragon)
 - [TheTyrius](https://github.com/TheTyrius)
+ - [Çağrı Sakaoğlu](https://github.com/ilovepilav)

 # Emby Contributors

@@ -229,3 +230,6 @@
 - [gnuyent](https://github.com/gnuyent)
 - [Matthew Jones](https://github.com/matthew-jones-uk)
 - [Jakob Kukla](https://github.com/jakobkukla)
+ - [Utku Özdemir](https://github.com/utkuozdemir)
+ - [JPUC1143](https://github.com/Jpuc1143/)
+ - [0x25CBFC4F](https://github.com/0x25CBFC4F)
--- a/Emby.Naming/Emby.Naming.csproj
+++ b/Emby.Naming/Emby.Naming.csproj
@@ -36,7 +36,7 @@
  <PropertyGroup>
    <Authors>Jellyfin Contributors</Authors>
    <PackageId>Jellyfin.Naming</PackageId>
-    <VersionPrefix>10.8.12</VersionPrefix>
+    <VersionPrefix>10.8.13</VersionPrefix>
    <RepositoryUrl>https://github.com/jellyfin/jellyfin</RepositoryUrl>
    <PackageLicenseExpression>GPL-3.0-only</PackageLicenseExpression>
  </PropertyGroup>
--- a/Emby.Server.Implementations/Updates/InstallationManager.cs
+++ b/Emby.Server.Implementations/Updates/InstallationManager.cs
@@ -324,9 +324,15 @@ namespace Emby.Server.Implementations.Updates
                }

                _completedInstallationsInternal.Add(package);
-                await _eventManager.PublishAsync(isUpdate
-                    ? (GenericEventArgs<InstallationInfo>)new PluginUpdatedEventArgs(package)
-                    : new PluginInstalledEventArgs(package)).ConfigureAwait(false);
+
+                if (isUpdate)
+                {
+                    await _eventManager.PublishAsync(new PluginUpdatedEventArgs(package)).ConfigureAwait(false);
+                }
+                else
+                {
+                    await _eventManager.PublishAsync(new PluginInstalledEventArgs(package)).ConfigureAwait(false);
+                }

                _applicationHost.NotifyPendingRestart();
            }
--- a/Jellyfin.Api/Controllers/AudioController.cs
+++ b/Jellyfin.Api/Controllers/AudioController.cs
@@ -91,18 +91,18 @@ namespace Jellyfin.Api.Controllers
        [ProducesAudioFile]
        public async Task<ActionResult> GetAudioStream(
            [FromRoute, Required] Guid itemId,
-            [FromQuery] string? container,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? container,
            [FromQuery] bool? @static,
            [FromQuery] string? @params,
            [FromQuery] string? tag,
            [FromQuery] string? deviceProfileId,
            [FromQuery] string? playSessionId,
-            [FromQuery] string? segmentContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? segmentContainer,
            [FromQuery] int? segmentLength,
            [FromQuery] int? minSegments,
            [FromQuery] string? mediaSourceId,
            [FromQuery] string? deviceId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] bool? enableAutoStreamCopy,
            [FromQuery] bool? allowVideoStreamCopy,
            [FromQuery] bool? allowAudioStreamCopy,
@@ -132,8 +132,8 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] int? cpuCoreLimit,
            [FromQuery] string? liveStreamId,
            [FromQuery] bool? enableMpegtsM2TsMode,
-            [FromQuery] string? videoCodec,
-            [FromQuery] string? subtitleCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? videoCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? subtitleCodec,
            [FromQuery] string? transcodeReasons,
            [FromQuery] int? audioStreamIndex,
            [FromQuery] int? videoStreamIndex,
@@ -262,12 +262,12 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] string? tag,
            [FromQuery] string? deviceProfileId,
            [FromQuery] string? playSessionId,
-            [FromQuery] string? segmentContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? segmentContainer,
            [FromQuery] int? segmentLength,
            [FromQuery] int? minSegments,
            [FromQuery] string? mediaSourceId,
            [FromQuery] string? deviceId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] bool? enableAutoStreamCopy,
            [FromQuery] bool? allowVideoStreamCopy,
            [FromQuery] bool? allowAudioStreamCopy,
@@ -297,8 +297,8 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] int? cpuCoreLimit,
            [FromQuery] string? liveStreamId,
            [FromQuery] bool? enableMpegtsM2TsMode,
-            [FromQuery] string? videoCodec,
-            [FromQuery] string? subtitleCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? videoCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? subtitleCodec,
            [FromQuery] string? transcodeReasons,
            [FromQuery] int? audioStreamIndex,
            [FromQuery] int? videoStreamIndex,
--- a/Jellyfin.Api/Controllers/ConfigurationController.cs
+++ b/Jellyfin.Api/Controllers/ConfigurationController.cs
@@ -125,12 +125,14 @@ namespace Jellyfin.Api.Controllers
        /// <param name="mediaEncoderPath">Media encoder path form body.</param>
        /// <response code="204">Media encoder path updated.</response>
        /// <returns>Status.</returns>
+        [Obsolete("This endpoint is obsolete.")]
        [HttpPost("MediaEncoder/Path")]
        [Authorize(Policy = Policies.FirstTimeSetupOrElevated)]
        [ProducesResponseType(StatusCodes.Status204NoContent)]
        public ActionResult UpdateMediaEncoderPath([FromBody, Required] MediaEncoderPathDto mediaEncoderPath)
        {
-            _mediaEncoder.UpdateEncoderPath(mediaEncoderPath.Path, mediaEncoderPath.PathType);
+            // API ENDPOINT DISABLED (NOOP) FOR SECURITY PURPOSES
+            //_mediaEncoder.UpdateEncoderPath(mediaEncoderPath.Path, mediaEncoderPath.PathType);
            return NoContent();
        }
    }
--- a/Jellyfin.Api/Controllers/DynamicHlsController.cs
+++ b/Jellyfin.Api/Controllers/DynamicHlsController.cs
@@ -174,18 +174,18 @@ namespace Jellyfin.Api.Controllers
        [ProducesPlaylistFile]
        public async Task<ActionResult> GetLiveHlsStream(
            [FromRoute, Required] Guid itemId,
-            [FromQuery] string? container,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? container,
            [FromQuery] bool? @static,
            [FromQuery] string? @params,
            [FromQuery] string? tag,
            [FromQuery] string? deviceProfileId,
            [FromQuery] string? playSessionId,
-            [FromQuery] string? segmentContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? segmentContainer,
            [FromQuery] int? segmentLength,
            [FromQuery] int? minSegments,
            [FromQuery] string? mediaSourceId,
            [FromQuery] string? deviceId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] bool? enableAutoStreamCopy,
            [FromQuery] bool? allowVideoStreamCopy,
            [FromQuery] bool? allowAudioStreamCopy,
@@ -215,8 +215,8 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] int? cpuCoreLimit,
            [FromQuery] string? liveStreamId,
            [FromQuery] bool? enableMpegtsM2TsMode,
-            [FromQuery] string? videoCodec,
-            [FromQuery] string? subtitleCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? videoCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? subtitleCodec,
            [FromQuery] string? transcodeReasons,
            [FromQuery] int? audioStreamIndex,
            [FromQuery] int? videoStreamIndex,
@@ -426,12 +426,12 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] string? tag,
            [FromQuery] string? deviceProfileId,
            [FromQuery] string? playSessionId,
-            [FromQuery] string? segmentContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? segmentContainer,
            [FromQuery] int? segmentLength,
            [FromQuery] int? minSegments,
            [FromQuery, Required] string mediaSourceId,
            [FromQuery] string? deviceId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] bool? enableAutoStreamCopy,
            [FromQuery] bool? allowVideoStreamCopy,
            [FromQuery] bool? allowAudioStreamCopy,
@@ -463,8 +463,8 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] int? cpuCoreLimit,
            [FromQuery] string? liveStreamId,
            [FromQuery] bool? enableMpegtsM2TsMode,
-            [FromQuery] string? videoCodec,
-            [FromQuery] string? subtitleCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? videoCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? subtitleCodec,
            [FromQuery] string? transcodeReasons,
            [FromQuery] int? audioStreamIndex,
            [FromQuery] int? videoStreamIndex,
@@ -596,12 +596,12 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] string? tag,
            [FromQuery] string? deviceProfileId,
            [FromQuery] string? playSessionId,
-            [FromQuery] string? segmentContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? segmentContainer,
            [FromQuery] int? segmentLength,
            [FromQuery] int? minSegments,
            [FromQuery, Required] string mediaSourceId,
            [FromQuery] string? deviceId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] bool? enableAutoStreamCopy,
            [FromQuery] bool? allowVideoStreamCopy,
            [FromQuery] bool? allowAudioStreamCopy,
@@ -632,8 +632,8 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] int? cpuCoreLimit,
            [FromQuery] string? liveStreamId,
            [FromQuery] bool? enableMpegtsM2TsMode,
-            [FromQuery] string? videoCodec,
-            [FromQuery] string? subtitleCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? videoCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? subtitleCodec,
            [FromQuery] string? transcodeReasons,
            [FromQuery] int? audioStreamIndex,
            [FromQuery] int? videoStreamIndex,
@@ -762,12 +762,12 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] string? tag,
            [FromQuery] string? deviceProfileId,
            [FromQuery] string? playSessionId,
-            [FromQuery] string? segmentContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? segmentContainer,
            [FromQuery] int? segmentLength,
            [FromQuery] int? minSegments,
            [FromQuery] string? mediaSourceId,
            [FromQuery] string? deviceId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] bool? enableAutoStreamCopy,
            [FromQuery] bool? allowVideoStreamCopy,
            [FromQuery] bool? allowAudioStreamCopy,
@@ -799,8 +799,8 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] int? cpuCoreLimit,
            [FromQuery] string? liveStreamId,
            [FromQuery] bool? enableMpegtsM2TsMode,
-            [FromQuery] string? videoCodec,
-            [FromQuery] string? subtitleCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? videoCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? subtitleCodec,
            [FromQuery] string? transcodeReasons,
            [FromQuery] int? audioStreamIndex,
            [FromQuery] int? videoStreamIndex,
@@ -930,12 +930,12 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] string? tag,
            [FromQuery] string? deviceProfileId,
            [FromQuery] string? playSessionId,
-            [FromQuery] string? segmentContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? segmentContainer,
            [FromQuery] int? segmentLength,
            [FromQuery] int? minSegments,
            [FromQuery] string? mediaSourceId,
            [FromQuery] string? deviceId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] bool? enableAutoStreamCopy,
            [FromQuery] bool? allowVideoStreamCopy,
            [FromQuery] bool? allowAudioStreamCopy,
@@ -966,8 +966,8 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] int? cpuCoreLimit,
            [FromQuery] string? liveStreamId,
            [FromQuery] bool? enableMpegtsM2TsMode,
-            [FromQuery] string? videoCodec,
-            [FromQuery] string? subtitleCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? videoCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? subtitleCodec,
            [FromQuery] string? transcodeReasons,
            [FromQuery] int? audioStreamIndex,
            [FromQuery] int? videoStreamIndex,
@@ -1107,12 +1107,12 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] string? tag,
            [FromQuery] string? deviceProfileId,
            [FromQuery] string? playSessionId,
-            [FromQuery] string? segmentContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? segmentContainer,
            [FromQuery] int? segmentLength,
            [FromQuery] int? minSegments,
            [FromQuery] string? mediaSourceId,
            [FromQuery] string? deviceId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] bool? enableAutoStreamCopy,
            [FromQuery] bool? allowVideoStreamCopy,
            [FromQuery] bool? allowAudioStreamCopy,
@@ -1144,8 +1144,8 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] int? cpuCoreLimit,
            [FromQuery] string? liveStreamId,
            [FromQuery] bool? enableMpegtsM2TsMode,
-            [FromQuery] string? videoCodec,
-            [FromQuery] string? subtitleCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? videoCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? subtitleCodec,
            [FromQuery] string? transcodeReasons,
            [FromQuery] int? audioStreamIndex,
            [FromQuery] int? videoStreamIndex,
@@ -1288,12 +1288,12 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] string? tag,
            [FromQuery] string? deviceProfileId,
            [FromQuery] string? playSessionId,
-            [FromQuery] string? segmentContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? segmentContainer,
            [FromQuery] int? segmentLength,
            [FromQuery] int? minSegments,
            [FromQuery] string? mediaSourceId,
            [FromQuery] string? deviceId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] bool? enableAutoStreamCopy,
            [FromQuery] bool? allowVideoStreamCopy,
            [FromQuery] bool? allowAudioStreamCopy,
@@ -1324,8 +1324,8 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] int? cpuCoreLimit,
            [FromQuery] string? liveStreamId,
            [FromQuery] bool? enableMpegtsM2TsMode,
-            [FromQuery] string? videoCodec,
-            [FromQuery] string? subtitleCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? videoCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? subtitleCodec,
            [FromQuery] string? transcodeReasons,
            [FromQuery] int? audioStreamIndex,
            [FromQuery] int? videoStreamIndex,
--- a/Jellyfin.Api/Controllers/UniversalAudioController.cs
+++ b/Jellyfin.Api/Controllers/UniversalAudioController.cs
@@ -102,13 +102,13 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] string? mediaSourceId,
            [FromQuery] string? deviceId,
            [FromQuery] Guid? userId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] int? maxAudioChannels,
            [FromQuery] int? transcodingAudioChannels,
            [FromQuery] int? maxStreamingBitrate,
            [FromQuery] int? audioBitRate,
            [FromQuery] long? startTimeTicks,
-            [FromQuery] string? transcodingContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? transcodingContainer,
            [FromQuery] string? transcodingProtocol,
            [FromQuery] int? maxAudioSampleRate,
            [FromQuery] int? maxAudioBitDepth,
--- a/Jellyfin.Api/Controllers/VideosController.cs
+++ b/Jellyfin.Api/Controllers/VideosController.cs
@@ -318,18 +318,18 @@ namespace Jellyfin.Api.Controllers
        [ProducesVideoFile]
        public async Task<ActionResult> GetVideoStream(
            [FromRoute, Required] Guid itemId,
-            [FromQuery] string? container,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? container,
            [FromQuery] bool? @static,
            [FromQuery] string? @params,
            [FromQuery] string? tag,
            [FromQuery] string? deviceProfileId,
            [FromQuery] string? playSessionId,
-            [FromQuery] string? segmentContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? segmentContainer,
            [FromQuery] int? segmentLength,
            [FromQuery] int? minSegments,
            [FromQuery] string? mediaSourceId,
            [FromQuery] string? deviceId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] bool? enableAutoStreamCopy,
            [FromQuery] bool? allowVideoStreamCopy,
            [FromQuery] bool? allowAudioStreamCopy,
@@ -361,8 +361,8 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] int? cpuCoreLimit,
            [FromQuery] string? liveStreamId,
            [FromQuery] bool? enableMpegtsM2TsMode,
-            [FromQuery] string? videoCodec,
-            [FromQuery] string? subtitleCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? videoCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? subtitleCodec,
            [FromQuery] string? transcodeReasons,
            [FromQuery] int? audioStreamIndex,
            [FromQuery] int? videoStreamIndex,
@@ -578,12 +578,12 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] string? tag,
            [FromQuery] string? deviceProfileId,
            [FromQuery] string? playSessionId,
-            [FromQuery] string? segmentContainer,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? segmentContainer,
            [FromQuery] int? segmentLength,
            [FromQuery] int? minSegments,
            [FromQuery] string? mediaSourceId,
            [FromQuery] string? deviceId,
-            [FromQuery] string? audioCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? audioCodec,
            [FromQuery] bool? enableAutoStreamCopy,
            [FromQuery] bool? allowVideoStreamCopy,
            [FromQuery] bool? allowAudioStreamCopy,
@@ -615,8 +615,8 @@ namespace Jellyfin.Api.Controllers
            [FromQuery] int? cpuCoreLimit,
            [FromQuery] string? liveStreamId,
            [FromQuery] bool? enableMpegtsM2TsMode,
-            [FromQuery] string? videoCodec,
-            [FromQuery] string? subtitleCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? videoCodec,
+            [FromQuery][RegularExpression(EncodingHelper.ValidationRegex)] string? subtitleCodec,
            [FromQuery] string? transcodeReasons,
            [FromQuery] int? audioStreamIndex,
            [FromQuery] int? videoStreamIndex,
--- a/Jellyfin.Data/Jellyfin.Data.csproj
+++ b/Jellyfin.Data/Jellyfin.Data.csproj
@@ -18,7 +18,7 @@
  <PropertyGroup>
    <Authors>Jellyfin Contributors</Authors>
    <PackageId>Jellyfin.Data</PackageId>
-    <VersionPrefix>10.8.12</VersionPrefix>
+    <VersionPrefix>10.8.13</VersionPrefix>
    <RepositoryUrl>https://github.com/jellyfin/jellyfin</RepositoryUrl>
    <PackageLicenseExpression>GPL-3.0-only</PackageLicenseExpression>
  </PropertyGroup>
--- a/MediaBrowser.Common/MediaBrowser.Common.csproj
+++ b/MediaBrowser.Common/MediaBrowser.Common.csproj
@@ -8,7 +8,7 @@
  <PropertyGroup>
    <Authors>Jellyfin Contributors</Authors>
    <PackageId>Jellyfin.Common</PackageId>
-    <VersionPrefix>10.8.12</VersionPrefix>
+    <VersionPrefix>10.8.13</VersionPrefix>
    <RepositoryUrl>https://github.com/jellyfin/jellyfin</RepositoryUrl>
    <PackageLicenseExpression>GPL-3.0-only</PackageLicenseExpression>
  </PropertyGroup>
--- a/MediaBrowser.Controller/MediaBrowser.Controller.csproj
+++ b/MediaBrowser.Controller/MediaBrowser.Controller.csproj
@@ -8,7 +8,7 @@
  <PropertyGroup>
    <Authors>Jellyfin Contributors</Authors>
    <PackageId>Jellyfin.Controller</PackageId>
-    <VersionPrefix>10.8.12</VersionPrefix>
+    <VersionPrefix>10.8.13</VersionPrefix>
    <RepositoryUrl>https://github.com/jellyfin/jellyfin</RepositoryUrl>
    <PackageLicenseExpression>GPL-3.0-only</PackageLicenseExpression>
  </PropertyGroup>
--- a/MediaBrowser.Controller/MediaEncoding/EncodingHelper.cs
+++ b/MediaBrowser.Controller/MediaEncoding/EncodingHelper.cs
@@ -25,6 +25,11 @@ namespace MediaBrowser.Controller.MediaEncoding
 {
    public class EncodingHelper
    {
+        /// <summary>
+        /// The codec validation regex.
+        /// </summary>
+        public const string ValidationRegex = @"^[a-zA-Z0-9\-\._,|]{0,40}$";
+
        private const string QsvAlias = "qs";
        private const string VaapiAlias = "va";
        private const string D3d11vaAlias = "dx11";
@@ -36,6 +41,8 @@ namespace MediaBrowser.Controller.MediaEncoding
        private readonly ISubtitleEncoder _subtitleEncoder;
        private readonly IConfiguration _config;

+        private static readonly Regex _validationRegex = new(ValidationRegex, RegexOptions.Compiled);
+
        // i915 hang was fixed by linux 6.2 (3f882f2)
        private readonly Version _minKerneli915Hang = new Version(5, 18);
        private readonly Version _maxKerneli915Hang = new Version(6, 1, 3);
@@ -253,7 +260,10 @@ namespace MediaBrowser.Controller.MediaEncoding
                    return "libtheora";
                }

-                return codec.ToLowerInvariant();
+                if (_validationRegex.IsMatch(codec))
+                {
+                    return codec.ToLowerInvariant();
+                }
            }

            return "copy";
@@ -276,7 +286,7 @@ namespace MediaBrowser.Controller.MediaEncoding

        public static string GetInputFormat(string container)
        {
-            if (string.IsNullOrEmpty(container))
+            if (string.IsNullOrEmpty(container) || !_validationRegex.IsMatch(container))
            {
                return null;
            }
@@ -523,6 +533,11 @@ namespace MediaBrowser.Controller.MediaEncoding
        {
            var codec = state.OutputAudioCodec;

+            if (!_validationRegex.IsMatch(codec))
+            {
+                codec = "aac";
+            }
+
            if (string.Equals(codec, "aac", StringComparison.OrdinalIgnoreCase))
            {
                // Use libfdk_aac for better audio quality if using custom build of FFmpeg which has fdk_aac support
--- a/MediaBrowser.Model/MediaBrowser.Model.csproj
+++ b/MediaBrowser.Model/MediaBrowser.Model.csproj
@@ -8,7 +8,7 @@
  <PropertyGroup>
    <Authors>Jellyfin Contributors</Authors>
    <PackageId>Jellyfin.Model</PackageId>
-    <VersionPrefix>10.8.12</VersionPrefix>
+    <VersionPrefix>10.8.13</VersionPrefix>
    <RepositoryUrl>https://github.com/jellyfin/jellyfin</RepositoryUrl>
    <PackageLicenseExpression>GPL-3.0-only</PackageLicenseExpression>
  </PropertyGroup>
--- a/SharedVersion.cs
+++ b/SharedVersion.cs
@@ -1,4 +1,4 @@
 using System.Reflection;

-[assembly: AssemblyVersion("10.8.12")]
-[assembly: AssemblyFileVersion("10.8.12")]
+[assembly: AssemblyVersion("10.8.13")]
+[assembly: AssemblyFileVersion("10.8.13")]
--- a/build.yaml
+++ b/build.yaml
@@ -1,7 +1,7 @@
 ---
 # We just wrap `build` so this is really it
 name: "jellyfin"
-version: "10.8.12"
+version: "10.8.13"
 packages:
  - debian.amd64
  - debian.arm64
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+jellyfin-server (10.8.13-1) unstable; urgency=medium
+
+  * New upstream version 10.8.13; release changelog at https://github.com/jellyfin/jellyfin/releases/tag/v10.8.13
+
+ -- Jellyfin Packaging Team <packaging@jellyfin.org>  Tue, 28 Nov 2023 22:21:55 -0500
+
 jellyfin-server (10.8.12-1) unstable; urgency=medium

  * New upstream version 10.8.12; release changelog at https://github.com/jellyfin/jellyfin/releases/tag/v10.8.12
--- a/debian/metapackage/jellyfin
+++ b/debian/metapackage/jellyfin
@@ -5,7 +5,7 @@ Homepage: https://jellyfin.org
 Standards-Version: 3.9.2

 Package: jellyfin
-Version: 10.8.12
+Version: 10.8.13
 Maintainer: Jellyfin Packaging Team <packaging@jellyfin.org>
 Depends: jellyfin-server, jellyfin-web
 Description: Provides the Jellyfin Free Software Media System
--- a/fedora/jellyfin.spec
+++ b/fedora/jellyfin.spec
@@ -7,7 +7,7 @@
 %endif

 Name:           jellyfin
-Version:        10.8.12
+Version:        10.8.13
 Release:        1%{?dist}
 Summary:        The Free Software Media System
 License:        GPLv2
@@ -179,6 +179,8 @@ fi
 %systemd_postun_with_restart jellyfin.service

 %changelog
+* Tue Nov 28 2023 Jellyfin Packaging Team <packaging@jellyfin.org>
+- New upstream version 10.8.13; release changelog at https://github.com/jellyfin/jellyfin/releases/tag/v10.8.13
 * Sat Nov 04 2023 Jellyfin Packaging Team <packaging@jellyfin.org>
 - New upstream version 10.8.12; release changelog at https://github.com/jellyfin/jellyfin/releases/tag/v10.8.12
 * Sat Sep 23 2023 Jellyfin Packaging Team <packaging@jellyfin.org>
--- a/src/Jellyfin.Extensions/Jellyfin.Extensions.csproj
+++ b/src/Jellyfin.Extensions/Jellyfin.Extensions.csproj
@@ -13,7 +13,7 @@
  <PropertyGroup>
    <Authors>Jellyfin Contributors</Authors>
    <PackageId>Jellyfin.Extensions</PackageId>
-    <VersionPrefix>10.8.12</VersionPrefix>
+    <VersionPrefix>10.8.13</VersionPrefix>
    <RepositoryUrl>https://github.com/jellyfin/jellyfin</RepositoryUrl>
    <PackageLicenseExpression>GPL-3.0-only</PackageLicenseExpression>
  </PropertyGroup>
Author	SHA1	Message	Date
Joshua M. Boniface	e93d03d8cb	Bump version to 10.8.13	2023-11-28 22:21:57 -05:00
Joshua M. Boniface	a656799dc8	Merge pull request from GHSA-866x-wj5j-2vf4 Validate codec and container	2023-11-28 22:20:32 -05:00
Joshua M. Boniface	83d2c69516	Merge pull request from GHSA-rr9h-w522-cvmr Remove the functionality of /System/MediaEncoder/Path	2023-11-28 22:19:55 -05:00
Cody Robibero	204fdeb035	Validate codec and container	2023-11-28 15:21:32 -07:00
Joshua M. Boniface	c4cdcb73fc	Merge pull request #10625 from ilovepilav/fix-alerts-missing-from-admin-dashboard Fix: Plugin Installed Alerts missing from Admin Dashboard #10620 (cherry picked from commit `2f6536e34b`) Signed-off-by: Joshua M. Boniface <joshua@boniface.me>	2023-11-27 00:19:32 -05:00
Joshua M. Boniface	1e0bd32358	Set Path endpoint obsolete	2023-11-26 18:33:13 -05:00
Joshua M. Boniface	bf5f00a383	Restore original flag behaviour	2023-11-23 13:25:36 -05:00
Joshua M. Boniface	0430ffecb6	Restore ordering	2023-11-23 01:44:35 -05:00
Joshua M. Boniface	85cfd080f1	Remove the functionality of /System/MediaEncoder/Path Eliminate this endpoint by having it perform no action, pending total removal in the next major version (10.9.0). Further, adjust the MediaEncoder startup options to completely ignore what is in the XML currently, and respect only the "--ffmpeg" arg, which is set on most of our platforms, falling back to system "ffmpeg" in $PATH if not found. This ensures that, should the "--ffmpeg" arg be changed by an administrator wishing to alter the default FFmpeg binary, this change will be reflected properly on next startup.	2023-11-22 21:29:32 -05:00