mirror of
https://github.com/jellyfin/jellyfin.git
synced 2026-07-16 05:43:54 +03:00
Require elevation for plugin configuration pages #5652
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @nielsvanvelzen on GitHub (Apr 30, 2024).
We've added additional security policies to the plugin endpoints in #11436. We did not add those to the plugin configuration pages due to time constraints for the 10.9 release. The web client requests these pages in an iframe (without authentication) and as such it needs additional changes.
We must secure this endpoint to avoid leaking plugin configuration pages and their related assets (JS/CSS/images etc). This might need changes in plugins too.
@jellyfin-bot commented on GitHub (Apr 30, 2024):
Hi, it seems like your issue report has the following item(s) that need to be addressed:
This is an automated message, currently under testing. Please file an issue here if you encounter any problems.