mirror of https://github.com/blakeblackshear/frigate.git synced 2026-10-20 13:42:47 +03:00

Files

T

Josh Hawkins 39567b37eb restrict go2rtc ${VAR} expansion in stream sources

go2rtc expands ${NAME:default} over the raw config text before parsing it, and falls back to the inline default when NAME is unset, so a stream source like ${NOPE:exec:<cmd>} passed the exec gate and go2rtc then ran the command. On master the API accepted the plain form, and startup accepted the ${{...}} form because .format collapsed it to ${...} after the check would have caught it. Any stream source containing ${ is now restricted unless GO2RTC_ALLOW_ARBITRARY_EXEC is set, the same as exec sources.

2026-10-19 22:31:22 -05:00

data

Detail XDNA2 community detector (#24480 )

2026-09-28 22:49:37 -06:00

docs

restrict go2rtc ${VAR} expansion in stream sources

2026-10-19 22:31:22 -05:00

plugins

Miscellaneous fixes (#23648 )

2026-07-07 10:56:43 -06:00

scripts

Merge detector and model in settings UI (#23216 )