mirror of
https://github.com/Vateron-Media/XC_VM.git
synced 2026-10-03 20:02:29 +02:00
57 lines
5.3 KiB
JSON
57 lines
5.3 KiB
JSON
{
|
|
"version": "2.5.2",
|
|
"changes": [
|
|
"Added the new Player v2 web application with SPA frontend assets, styles, scripts and vendored libraries.",
|
|
"Added Player v2 access-code authentication, scope wiring, stream and subtitle token generation, and Active Code login.",
|
|
"Hardened Player v2 against IDOR and XSS vulnerabilities and added proper escaping for catalog poster URLs and category emoji.",
|
|
"Restored player resize authorization and changed channel ACL handling to fail closed when authorization cannot be validated.",
|
|
"Expanded the Smart Activation Codes system with the complete code lifecycle and integration into admin, reseller, line and MAG workflows.",
|
|
"Added Category Templates with admin/reseller management and custom_data application.",
|
|
"Integrated category-template custom_data into Active Codes and restricted applyToAll operations according to template visibility.",
|
|
"Improved Active Code tables, localization, voucher-detail rendering, package/bouquet handling and reseller portal integration.",
|
|
"Fixed device-locked activation codes so they can only be used by their assigned device and only one concurrent request can activate a code.",
|
|
"Fixed Active Code information disclosure that could reveal the MAC address bound to a locked code.",
|
|
"Added a unique per-install OPENSSL_EXTRA secret for installation-specific cryptographic operations.",
|
|
"Added tamper-proof stream tokens using AES-256-GCM with per-panel configuration.",
|
|
"Hardened authentication with constant-time shared-secret and HMAC comparisons, fresh admin/reseller sessions and improved session cookies.",
|
|
"Restored login flood protection and improved access-control handling.",
|
|
"Hardened image resizing against SSRF and DNS rebinding, including vetted IP handling and TLS verification for outbound requests.",
|
|
"Removed credentialed reflected-Origin CORS behavior from the Player API.",
|
|
"Fixed reseller API authentication caused by operator-precedence issues.",
|
|
"Replaced the monolithic XC_Bootstrap flow with an injectable BootKernel pipeline.",
|
|
"Added PSR-4 ConstantsInitializer and ErrorResponder components and consolidated legacy bootstrap prelude shims.",
|
|
"Routed Web API database initialization through shared bootstrap stages and removed redundant streaming-path includes.",
|
|
"Added bootstrap tests covering stage skip paths, side effects and initialization behavior.",
|
|
"Centralized STATUS_* initialization and improved bootstrap documentation.",
|
|
"Moved frequently edited release constants to top-of-file define() declarations.",
|
|
"Added a dedicated Rector refactoring infrastructure with configuration, documentation and Make targets.",
|
|
"Applied reviewed Rector transformations across core, streaming, Public Controllers and Ministra code.",
|
|
"Performed multiple refactoring and convergence passes to simplify control flow, remove dead code and improve maintainability.",
|
|
"Decomposed RadioService processing and mass-edit logic into smaller tested helpers.",
|
|
"Converted inline XcVm fully-qualified references to PSR-4 imports.",
|
|
"Reworked database access to use DatabaseAware::db() instead of threading the global database object through call chains.",
|
|
"Expanded strict typing and corrected nullable parameter and PID handling across multiple components.",
|
|
"Restored security guards and include paths affected by unsafe automated refactoring.",
|
|
"Adopted K&R and tab formatting and expanded parameter type-hint requirements across the codebase.",
|
|
"Resolved PHPCS and PHPStan issues introduced during the refactoring process and updated the PHPStan dependency.",
|
|
"Added a dual-backend SQLite and MariaDB test database and improved test-environment guards.",
|
|
"Expanded core test coverage for database, cache, authorization, brute-force protection, settings, HTTP requests, update channels and module registries.",
|
|
"Added tests for ChannelService mass-edit and ordering behavior.",
|
|
"Moved phpunit.phar into tests/ and updated test references.",
|
|
"Added per-panel Responsive Tables configuration and profile appearance/customizer options.",
|
|
"Added bouquet sort controls for moving entries up, down, to the top or to the bottom.",
|
|
"Restored Users navigation tabs and fixed multiple new UI navigation and form submission issues.",
|
|
"Fixed stream creation without an icon, deletion of unpaired MAG/Enigma2 devices and missing Streams page Resources data.",
|
|
"Fixed CPU resource reporting so stream resource information is populated correctly and retained.",
|
|
"Added MediaAnalyzedEvent dispatch after successful VOD analysis.",
|
|
"Fixed VOD Range workers being terminated during concurrent requests.",
|
|
"Exposed bouquet ID, name and order in bouquet listing output.",
|
|
"Added FileCache safeguards and static deletion helpers.",
|
|
"Pinned database connections to utf8mb4 and restored nullable database-host support for CLI boot.",
|
|
"Fixed transactional database operations so Errors trigger rollback as well as Exceptions.",
|
|
"Fixed simultaneous on-demand viewer requests so a stopped stream is started only once.",
|
|
"Fixed live connection filtering and additional authentication, process-management and null-safety edge cases.",
|
|
"Updated bootstrap and contributor documentation and removed obsolete references to the old prelude architecture."
|
|
]
|
|
}
|